Step Functions Infrastructure, Roles, and Policies

[queueburt]

Changes to metaflow-cfn-template.yml:

Role and policy additions:

• Enable EventBridge and Step Functions access for Metaflow Isolated User
• Create Role for Step Functions to access Event Bridge, S3, DynamoDB, and Batch
• Create Role for Event Bridge to trigger Step Functions
• Modify Batch role to allow access to DynamoDB

Infrastructure Additions:

• DynamoDB for Step Functions state management

Fixes:

• Per feedback, creating an ECSInstanceProfile role that's specific to each stack's Batch deployment as opposed to relying on Batch's ecsInstanceRole.
• Also per feedback, making Sagemaker Notebooks an optional resource.

Addition of metaflow-cfn-ONLY-stepfunctions.yml:

• Addition of a template that only includes DynamoDB and respective roles. USE WITH CARE. This will require modification of existing roles by hand to enable access to DynamoDB from Batch and Batch from Step Functions.

[queueburt]

I'm feeling like I no longer like the idea of a separate CFN template in this PR to incorporate Step Functions in a standalone way. The only users it helps are manual deployers who suddenly want to use CFN for Step Functions, and it means we would now have two places to maintain parity for new features. @savingoyal I think I'm going to remove metaflow-cfn-ONLY-stepfunctions.yml from this PR (because if I don't I have to make a bunch of adjustments to support DB migration), but I wanted to float it out to the larger team before I do.

[savingoyal]

@queueburt Yes, let's remove metaflow-cfn-ONLY-stepfunctions.yml

[tobias-gp]

I just deployed the stack via CF, and it deploys just fine :) I haven't tested the SF functionality though.

[queueburt]

Final update: health-check port for the new traffic flow has been changed to 8080, and is passing in my test deployments. I'm comfortable calling this good-for-merge assuming some +1 love from @savingoyal @tobias-gp @ferras and @tuulos