add iam:CreateServiceLinkedRole to DeployService (#44194)

If the ECS service-linked role managed by AWS does not exist yet, then
when the OIDC integration calls ecs:CreateCluster it will fail.
Adding this permission will allow the API call to automatically
create the service-linked role on first use of ECS.

lib/cloud/aws/policy_statements.go

@@ -65,6 +65,9 @@ func StatementForECSManageService() *Statement {
 
 			// EC2 DescribeSecurityGroups is required so that the user can list the SG and then pick which ones they want to apply to the ECS Service.
 			"ec2:DescribeSecurityGroups",
+
+			// IAM CreateServiceLinkedRole is required to ensure the ECS Service linked role exists.
+			"iam:CreateServiceLinkedRole",
 		},
 		Resources: allResources,
 	}