the cfn-init routines need an IAM user and its keys