[ComputeOptimizerModule] Missing permission iam:UntagRole on ComputeOptimizer-StackSetExecutionRole

[CorinneVerheyde]

1. When upgrading datacollection stack on the local account with a change in default_tags, the upgrade and the rollback both failed (From version 3.4.2 to version 3.5.0).
   Our specific usecase is that we removed one of our standard tags (in the default provider tags).

provider "aws" {
  default_tags {
    tags = var.tags
  }
}

It seems that the role ComputeOptimizer-StackSetExecutionRole miss the permission iam:UntagRole. Could you add it ?

Steps to reproduce:

• Remove a tag in the default_tags provider.
• Try to upgrade.

2. In the same role, there is a non existing permission "s3:Set*".
   It does work, but there is a warning in the AWS console so this could be fixed too on the same issue ?

[iakov-aws]

Thanks for reporting this.

For reference the role is declared here: https://github.com/awslabs/cid-framework/blob/main/data-collection/deploy/module-compute-optimizer.yaml#L140C1-L140C32

Hey team, @aws-samples/cid-contributors can you have a look?