IAM write idempotency

[super-cob]

Some orgs might have requirements that IAM Write permissions are very strictly guarded, so it would be easiest for those orgs to have the IAM roles that terraform needs created in advance, and then the terraform apply operation should be able to find and use those pre-existing IAM roles instead of needing to create them each time.