Add cleanup flag to delete deactivated key if specified

[ymatsiuk]

As requested in #4

[stefansundin]

Note that the key that is used to delete the key was deactivated just above the deletion. It is probably fine as I think it takes a couple of seconds for the key deletion to propagate. But should probably be tested a bunch of times to see that it works reliably.

[ymatsiuk]

@stefansundin apparently if I re-read newly created .credentials file and create new session:

Error getting caller identity. Is the key disabled?

InvalidClientTokenId: The security token included in the request is invalid.
	status code: 403, request id: xx-xx-xx-xx

Will try to add the check + retry before doing this and see if it helps and how much time does it take for the new key to be available.

[stefansundin]

I think what you have is probably ok, just wanted to make sure it was tested thoroughly.

You could also just delete the old key and skip disabling it when -cleanup is used. If the key deletion failed, then it's probably ok to just print and error and not bother to fall back on disabling the key. In that case, the user should contact their AWS administrator to have the permissions updated to allow for that.

[ymatsiuk]

@stefansundin I polished a bit previous solution according to what we discussed in this PR.

[stefansundin]

I only have one last comment, but it's minor so I am also approving. :)

[stefansundin]

My only comment is that this text is the output from aws-rotate-key -help, which now will say:

  -d	Delete old key without deactivation.
  -profile string
    	The profile to use. (default "default")
  -version
    	Print version number (1.0.3)
  -y	Automatic "yes" to prompts.

It is not obvious that the text is from there. And I don't think we need to keep it exactly the same.

[boroivanov]

Thanks @ymatsiuk 👍

[boroivanov]

@ymatsiuk your changes were released with https://github.com/Fullscreen/aws-rotate-key/releases/tag/v1.0.4