fix(infra): scope DLM snapshot sharing to snapshot ARNs

ModifySnapshotAttribute on every resource can share a snapshot. The boundary allows it only on snapshot ARNs.

terraform/iam.tf

@@ -190,12 +190,18 @@ data "aws_iam_policy_document" "dlm_boundary" {
       "ec2:DescribeVolumes",
       "ec2:DisableFastSnapshotRestores",
       "ec2:EnableFastSnapshotRestores",
-      "ec2:ModifySnapshotAttribute",
       "ec2:ModifySnapshotTier",
     ]
     resources = ["*"]
   }
 
+  statement {
+    sid       = "SnapshotSharing"
+    effect    = "Allow"
+    actions   = ["ec2:ModifySnapshotAttribute"]
+    resources = ["arn:aws:ec2:*:*:snapshot/*"]
+  }
+
   statement {
     sid    = "SnapshotRules"
     effect = "Allow"