Add documentation on how to setup AWS IAM

[laroo]

It took me some time to find out on how to setup AWS IAM user/role/policy. Maybe it's helpful for other users on how to get started.

I created a user keymaker and create a policy to limit only listing users/groups and ssh keys:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowKeymakerToListAccounts",
            "Effect": "Allow",
            "Action": [
                "iam:ListAccountAliases",
                "iam:ListUsers",
                "iam:ListGroups",
                "iam:ListGroupsForUser",
                "iam:GetUser",
                "iam:GetGroup",
                "iam:ListSSHPublicKeys",
                "iam:GetSSHPublicKey"
            ],
            "Resource": "*"
        }
    ]
}

To have the user automatically added to IAM groups the group name must be prepended with keymaker_ AND must have the path /keymaker/. However it is not possible to create a group from Amazon AWS console and define the path, you must use CLI:

$ aws iam create-group --path "/keymaker/" --group-name keymaker_mylinuxgroup

Notes:

• Currently you must duplicate the groups in IAM: one with dash, one with underscore. See issue Inconsistent check on group prefix 'keymaker' #10
• All existing linux users not in the defined in the IAM keymaker group will be removed. See issue Existing linux users removed when syncing groups #11