Make KeyName optional

[zsims]

This closes #413, by making the KeyName parameter optional. The parameter type has to be changed to String as the AWS::EC2::KeyPair::KeyName typed parameter means a valid key name must be specified.

If no KeyName is specified, then the SSH ingress rule will not be created.

Some tests:

With a new stack

$ aws cloudformation create-stack --stack-name optional-ssh-zac --template-body file://build/aws-stack.json --parameters "ParameterKey=BuildkiteAgentToken,ParameterValue=secret" --capabilities CAPABILITY_NAMED_IAM
# ... 
CREATE_COMPLETE

Against an existing 3.2.1 stack

$ aws cloudformation create-change-set --stack-name buildkite --change-set-name optional-ssh-key-test --template-body file://build/aws-stack.json --parameters "ParameterKey=BuildkiteAgentToken,ParameterValue=secret" --capabilities CAPABILITY_NAMED_IAM
# ...
$ aws cloudformation describe-change-set --stack-name buildkite --change-set-name optional-ssh-key-test --query 'Changes[].ResourceChange.{LogicalResourceId:LogicalResourceId,Replacement:Replacement,Action:Action}'
[
    {
        "LogicalResourceId": "AgentAutoScaleGroup",
        "Replacement": "Conditional",
        "Action": "Modify"
    },
    {
        "LogicalResourceId": "AgentLaunchConfiguration",
        "Replacement": "True",
        "Action": "Modify"
    },
    {
        "LogicalResourceId": "AgentLifecycleHook",
        "Replacement": "Conditional",
        "Action": "Modify"
    },
    {
        "LogicalResourceId": "AgentScaleDownPolicy",
        "Replacement": "Conditional",
        "Action": "Modify"
    },
    {
        "LogicalResourceId": "AgentScaleUpPolicy",
        "Replacement": "Conditional",
        "Action": "Modify"
    },
    {
        "LogicalResourceId": "AgentUtilizationAlarmHigh",
        "Replacement": "False",
        "Action": "Modify"
    },
    {
        "LogicalResourceId": "AgentUtilizationAlarmLow",
        "Replacement": "False",
        "Action": "Modify"
    },
    {
        "LogicalResourceId": "SecurityGroup",
        "Replacement": "True",
        "Action": "Modify"
    },
    {
        "LogicalResourceId": "SecurityGroupSshIngress",
        "Replacement": null,
        "Action": "Add"
    }
]

[tbenade]

Awesome 1000

[lox]

This is looking great, thanks for this @zsims. My only feedback is that the conditional SSH ingress needs to also take into account AuthorizedUsersUrl which lets you provide a url for downloading authorized_keys from.

[zsims]

Thanks for the review @lox, have updated the PR with your suggestion

[lox]

This probably needs to be in an Fn::Or, or am I booleaning wrong?

[zsims]

Well that's embarrassing, good catch! I've pushed up a fix

[lox]

Cool, works for me!