Security Improvement's associated with Jira Task CSI-1647

[neoakris]

Summary of Changes:

1. Replaced execSync with shelljs
   • supposed to be trivially more secure
   • noteworthy improvement is before only stdout of commands was accessible. Now stderr & exit codes are also accessible/usable, which can make any if statement logic more reliable.
2. Security Improvement:
   • Removed: AWS Account root (as in any authenticated user/role within account) assumable eks cluster admin method (insecure default built into cdk's eks masterrole logic) has been removed.
     Here's what the output used to look like:

     Outputs:
     dev1-eks.dev1eksConfigCommand9B300592 = aws eks update-kubeconfig --name dev1-eks --region ca-central-1 --role-arn arn:aws:iam::905418347382:role/dev1-eks-assumableEKSAdminAccessRoleC284FA0F-F22KjKQrjLpO

   • Replaced with: Only allowing cluster admin access to IAM ARN List of Whitelisted Cluster Admins (and convenience logic to add the user/role running cdk deploy dev1-eks to said list to maintain similar UX to what originally existed.)
     Here's what the output now looks like: (quickstart doc was updated to reflect)

     Outputs:
     dev1-eks.iamWhitelistedKubeConfigCmd = aws eks update-kubeconfig --region ca-central-1 --name dev1-eks

3. Edge Case Bug Fix:
   • Duplicate Entries of config.addClusterAdminARN(arn:aws:iam::111122223333:user/example);
     would cause crash. Logic to prevent duplicates has been added.
   • Duplicate Entires of config.addClusterViewerAccount(process.env.CDK_DEFAULT_ACCOUNT!);
     would not cause any crash, nor issues, but it would result in duplicate entries in aws-auth configmap. Added logic to prevent duplicates here as well even though didn't hurt.
   • Verified tag duplicates were non-issue.