new keys
add instructions for recommended S3 IAM user setup