AWS IAM security improvements

[justinPemberton]

Overview

Improve IAM to make instituting procedures or policies easier

Action Items

Create issues to:

• Establish Multi-Factor Authentication to AWS users #22
• Research, review and document existing IAM setup and report bad policy or procedure Decision Record #60
• Research, Define, Document IAM max password policy Decision Record #59
• Research password requirements Decision record #62
• Analyse existing users and determine duplicate user accounts Decision record #63
• Research, define policy on max attempts before account lockdown Decision record #64
• Use it or lose it policy enablement Decision record #65
• Research policy of least-privilege permissions Decision record #61

Resources/Instructions

• https://docs.aws.amazon.com/IAM/latest/UserGuide/introduction.html
• OPS: IAM AWS
• https://github.com/hackforla/website/wiki/Decision-Records - Hack for LA team decision record examples

[JasonEb]

@justinPemberton can you break out Assignee's Instructions to a different issue

[ExperimentsInHonesty]

Template for child issues

### Overview
We need to figure out Industry Guidance and document what should be in the [name of thing] policy, so that we can create actionable HfLA best practices.

### Action Items
- [ ] Identify and document in a comment who is the authoritative source for guidance (might be multiple places), e.g., AWS, etc.
- [ ] Write up the recommendation in the form of a Decision Record as a draft comment.  Use template on (resource 1.01) and reference the source
- [ ] Add to DevOps team agenda (resource 1.02) for review and approval
- [ ] Add to wiki and link to (resource 1.01 and 1.03)

### Resources/Instructions
#### Used during issue
- 1.01 Decision Records Implemented
- 1.02 https://github.com/hackforla/ops/issues/100
- 1.03 Decision Records 

#### created by issue
2.01 Decision Record for [name of thing]