Provision user's `authorized_keys` in `import_users.sh`

[peay]

I have been testing a modification to import_users.sh will provision that user's .ssh/authorized_keys file during the regular users update from IAM.

My motivation is as follows:

• Using AuthorizedKeysCommand is slow, as we are invoking aws iam multiple times, which has a startup cost and roundtrip cost. In my testing, I've observed that 3-5s login times are common, which is rather slow compared to vanilla ssh with public keys stored locally where I average below 0.5s.

• New users need the script to be available locally, so checking their key at ssh login doesn't help make them available sooner anyway.

• Existing users can add their key to .ssh/authorized_keys and retain access for up to 10min even if their key is removed from IAM, so checking their key at ssh login doesn't help make them become blocked sooner either.

This change would be optional in import_users.sh, and AuthorizedKeysCommand can still be used if an almost-immediate update to keys of existing users is required and the up-to-10m delay is not acceptable for key updates.

Would this be a welcome contribution to the project?

[csakshaug]

@peay What about creating a PR and perhaps @michaelwittig would merge it or make some changes to it :-)

import_users.sh

[michaelwittig]

I think this could better be a separate project? Feel free to create a link in the README to point to the "cached" solution.