Feat/DL-148: Allow data-and-insight to use PassRole on datahub-task-execution-role (#2590)

* DL-148 allow PassRole on datahub-task-execution-role

* simplify a bit

Author: Tian-2017

terraform/modules/department/50-aws-iam-policies.tf

@@ -1273,10 +1273,15 @@ data "aws_iam_policy_document" "department_ecs_passrole" {
     actions = [
       "iam:PassRole"
     ]
-    resources = [
-      aws_iam_role.department_ecs_role.arn,                                                                                  # Defined in 50-aws-iam-roles.tf
-      "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${local.department_identifier}*-ecs-execution-role", # Defined in ecs repo.
-    ]
+    resources = concat(
+      [
+        aws_iam_role.department_ecs_role.arn,                                                                                  # Defined in 50-aws-iam-roles.tf
+        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/${local.department_identifier}*-ecs-execution-role", # Defined in ecs repo.
+      ],
+      local.department_identifier == "data-and-insight" ? [
+        "arn:aws:iam::${data.aws_caller_identity.current.account_id}:role/datahub-task-execution-role" # Defined in dap-datahub repo
+      ] : []
+    )
     condition {
       test     = "StringEquals"
       variable = "iam:PassedToService"