[IT-3559] Allow multiple bucket and prefix inputs

[zaro0508]

Add the ability to pass in multiple bucket Arn and Prefix to the snowflake access template.

• Change to jinja template
• Update to accept a matched set of bucket and prefix inputs

[zaro0508]

example:

passing in these parameters from sceptre config..

sceptre_user_data:
  Buckets:
    - Arn: MyBucketArn1
      Prefix: MyPrefix1
    - Arn: MyBucketArn2
      Prefix: MyPrefix2

will generate this template..

---
Description: >
  Setup cross account IAM access to a bucket/prefix for Snowflake.
  See https://docs.snowflake.com/en/user-guide/data-load-s3-config-storage-integration
AWSTemplateFormatVersion: 2010-09-09
Parameters:
  SnowflakeAccountArn:
    Type: String
  SnowflakeAccountExternalId:
    Type: String
Resources:
  SnowflakeServicePolicy:
    Type: 'AWS::IAM::ManagedPolicy'
    Properties:
      PolicyDocument:
        Version: '2012-10-17'
        Statement:

          - Effect: Allow
            Action:
              - 's3:GetObject'
              - 's3:GetObjectVersion'
            Resource: "MyBucketArn1/MyPrefix1/*"
          - Effect: Allow
            Action:
              - 's3:ListBucket'
              - 's3:GetBucketLocation'
            Resource: "MyBucketArn1"
            Condition:
              StringLike:
                's3:prefix': "MyPrefix1/*"

          - Effect: Allow
            Action:
              - 's3:GetObject'
              - 's3:GetObjectVersion'
            Resource: "MyBucketArn2/MyPrefix2/*"
          - Effect: Allow
            Action:
              - 's3:ListBucket'
              - 's3:GetBucketLocation'
            Resource: "MyBucketArn2"
            Condition:
              StringLike:
                's3:prefix': "MyPrefix2/*"

  SnowflakeServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
      Path: "/"
      ManagedPolicyArns:
        - !Ref SnowflakeServicePolicy
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              AWS: !Sub ${SnowflakeAccountArn}
            Action:
              - sts:AssumeRole
              - sts:TagSession
            Condition:
              StringEquals:
                sts:ExternalId: !Sub ${SnowflakeAccountExternalId}
Outputs:
  SnowflakeServiceRoleArn:
    Value: !GetAtt SnowflakeServiceRole.Arn
    Export:
      Name: !Sub '${AWS::StackName}-SnowflakeServiceRoleArn'