Decouples IAM terraform from the `live` repository

* Moves the `iam` modules into subdirectory of `submodules`.
* Moves the terraform source into `base/iam`
* Uses variables to standardize the terragrunt.hcl in
  `xdr-terraform-live`

base/iam/main.tf

@@ -0,0 +1,8 @@
+module "iam_roles" {
+  source = "../../submodules/iam/child_account_roles"
+  account_alias = var.account_name
+
+  assume_role_trusted_arns  = [
+    "arn:${var.aws_partition}:iam::${var.common_services_account}:role/user/mdr_engineer_readonly",
+  ]
+}

base/iam/outputs.tf

@@ -0,0 +1,3 @@
+#output "TODO" {
+#  value = TODO
+#}

base/iam/vars.tf

@@ -0,0 +1,30 @@
+# No local module inputs (yet)
+
+# ----------------------------------
+# Below this line are variables inherited from higher levels, so they
+# do not need to be explicitly passed to this module.
+variable "account_name" {
+  type = string
+}
+
+# ----------------------------------
+# Required for remote state, though they can be used elsewhere
+variable "remote_state_bucket" {
+  type = string
+}
+
+variable "aws_region" {
+  type = string
+}
+
+variable "aws_partition" {
+  type = string
+}
+
+variable "common_services_account" {
+  type = string
+}
+
+variable "common_profile" {
+  type = string
+}

submodules/iam/standard_iam_policies/versions.tf

@@ -0,0 +1,3 @@
+terraform {
+  required_version = ">= 0.12, < 0.13"
+}