EUCA-5741: restrive IAM policy for servo VM's role
 -- put role policy to the servo vm's role
 -- only allow two servo-related operations to the role
 -- additional fix to IAM role implementation to allow lookup of resource name = *
Merge branch 'dev/spark/EUCA-5741' into dev/spark/services