add documentation to specify trusted CA for EC2
===GT=== #3730