Update/Fix EC2 Policies

[Nuru]

Warning

When the DenyEC2NonNitroInstances policy was first introduced, it was primarily intended
to ensure that network traffic was encrypted in transit, which was seen to be a feature
that all Nitro instances supported and all non-Nitro instances did not. However, this
is not the case, as instance families such as a1, t3, and t4g are Nitro based but
do not support network traffic encryption in transit.

As such, the DenyEC2NonNitroInstances policy is not a reliable way to ensure that
network traffic is encrypted in transit. It is recommended that you use the
DenyEC2InstancesWithoutEncryptionInTransit policy instead if that is your goal.

what

• Update/fix EC2 Policies DenyEC2InstancesWithoutEncryptionInTransit and DenyEC2NonNitroInstances
• Update test framework (even though testing does not work)

why

• Prior policies exceeded 5120-character length limit and were also out of date
• Satisfy Dependabot

references

• Fixes SCPs DenyEC2NonNitroInstances and DenyEC2InstancesWithoutEncryptionInTransit are too big #34

[dudymas]

lgtm. Thanks for the fix and the explanation on the nitro instance changes.