data-engineer (PDS-CDS account): Identify required resources and access

[jordanpadams]

Summary

Identify and document the IAM permissions and AWS services required for the Tenant Data Engineer cross-account roles in each PDS-CDS environment (dev/test/prod).

Tasks

• Identify all AWS services and actions needed (Airflow DAG management, S3 staging, OpenSearch/AOSS, Lambda invocation)
• Confirm trust policy requirements for cross-account assumption from tenant node accounts
• Document per-environment differences if any (dev vs test vs prod)
• Review with SA team and get sign-off

Parent Theme

Part of #234