AWS service account for Eagle and Kestrel

[nmerket]

Is your feature request related to a problem? Please describe.

We're moving everyone to SSO, so people won't have individual IAM account keys to use anymore.

Describe the solution you'd like

Create a limited service account that has only the permissions we need and no console access, and set the software to look for that in the appropriate place on Kestrel and Eagle first. This has the added bonus that users no longer need to manage their keys in their own accounts, it should "just work".

Describe alternatives you've considered

We haven't been able to think of any better alternatives.