Support AWS Instance Identity Documents

[mcpherrinm]

Today, sharkey requires having an x.509 certificate for the host.

AWS has instance identity documents: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-identity-documents.html

Perhaps we could support a client that submits an identity document instead of authenticating with a client certificate.

We'd still need a way to tie an instance document to the hostname(s) we should allow that instance to have, and we should be careful about the security implications here.

[csstaub]

👍 this sounds amazing.

[mcpherrinm]

We're going to outsource all of this sort of thing to SPIFFE