Feature request: Move minimal permission policies to source repo

[Rennie deGraaf]

The minimal permission policy required for AWS scans is currently maintained in the GitHub wiki: https://github.com/nccgroup/ScoutSuite/wiki/AWS-Minimal-Privileges-Policy. Only project maintainers can edit that wiki; it is not possible for a third-party pull request that adds new features to ScoutSuite that require new permissions to also update that documentation. As a result, the documented minimal permission policy has often fallen behind the permissions actually required by ScoutSuite. For instance, see #420, #519, #1410, #1490, and #1498.

This issue is not unique to AWS; there are open issues to document minimal permission policies for Aliyun (#837) and GCP (#1513). If such minimal permission policies are added to the wiki, then they will become subject to the same issues.

Describe the solution you'd like

If we move the recommended permission policy into the source repo, then the wiki can link to that file in the latest release branch.

This is not a perfect solution. However, its limitations can be mitigated:

• The wiki link must be updated when a new release is made. However, readers will at least have the ability to notice that the link points to a previous release tag and manually track down the right one. Updating that link should be added to the release process. Or ScoutSuite should have a "latest" tag that always points at the latest release.
• Developers may forget to add new permissions that their checks require to the minimal permission policy. A new checkbox should be added to the MR template asking developers to confirm that their features work using the minimal permission policy and if not, that the MR also includes an update to the minimal permission policy.

Describe alternatives you've considered

It might be possible to allow contributors to submit patches to the wiki along with their MRs. This is likely to be complicated. An additional complicating factor is that the wiki should reflect the latest release, not the latest patch accepted into the develop branch. Consequently, this solution is probably not viable.

A step could be added to the release workflow to review all changes since the last release, identify new permissions required by those changes, and update the wiki. This seems like an unnecessary imposition on the ScoutSuite maintainers and subject to error.

Additional context

Add any other context or screenshots about the feature request here.