Don't check for existence, but recover if it happens

This reduces the number of API calls in the expected path, without
increasing the total in the alternative one. It also handles a race
where role/instance profile is created after the initial check.
This didn't look right...
If the role exists, just delete all the policies

A small penalty for the unexpected case, but it simplifies the code and
avoids the extra logic. Also, the expected case is now tracked and no
policy deletion is attempted.
Move instance profile creation earlier

Eventual consistency can be a pain. For instance profiles, creating them
and immediately attempting to create ASG launch configurations that
refer to them (such as could be done in a deployment script orchestrated
with hc2002 :-), can lead to surprises.

While this isn't likely to fix that problem, well, anything that may
help is welcome.

This also simplifies code in the unexpected code path, potentially at
the cost of one extra IAM call.
Fix use of undefined variable
Allow for different AWS services to catch up to IAM

When creating roles and launch configurations in "quick succession", as
might happen if you script these things, it is not uncommon for
AutoScaling APIs to report that the instance profile doesn't exist. When
this happens, it is typically some long seconds before AutoScaling picks
it up.

This adds retries on queries that rely on roles existing, to give time
for IAM roles to become visible to other AWS services. 5 seconds seems
to be in the right ballpark, but it frequently takes more time for
AutoScaling to pick up newly created profile.

Tagging of newly created instances is also hampered by this type of lag.
Anecdotally, this seems more frequent when instance provisioning
requires EBS volumes to be created/attached, but is prone to happen in
other circumstances as well.
Add support for upload if blob doesn't exist (S3)

By default, PUT'ing a blob in S3 will overwrite a previous one with the
same key. Boto supports a 'replace' argument which will do a HEAD
request to check whether the key already exists.

Although there is no atomicity guaranteed, this is useful in situations
where one isn't trying to protect against races, just trying to avoid
duplicate uploads.

This exposes that argument in our blob API.