document some of the required AWS config

pipelines/shared-tasks/cleanup-aws/task.sh

@@ -92,4 +92,7 @@ set +o pipefail
 # continually send "tua-test1" to stdin to serve as a confirmation for aws-nuke.
 # this is done in a loop since aws-nuke uses a new buffered reader to consume
 # stdin each time it wants to accept input from the user.
+# Note that the AWS account being used to run this tool must have an AWS account
+# alias with this "tua-test1" name. See https://stackoverflow.com/a/54322848.
+# If you assign the account a different alias, then you need to change it here too.
 (while true; do echo tua-test1; sleep 1; done) | ${cmd}

pipelines/shared-tasks/deploy-eks-cluster/task.sh

@@ -1,6 +1,6 @@
 #!/bin/bash
 
-# Copyright 2020-2024 the Pinniped contributors. All Rights Reserved.
+# Copyright 2020-2025 the Pinniped contributors. All Rights Reserved.
 # SPDX-License-Identifier: Apache-2.0
 
 set -euo pipefail
@@ -32,6 +32,8 @@ echo "$CLUSTER_NAME" > name
 # The kubeconfig file becomes the value of the lock in the pool.
 echo "Creating $CLUSTER_NAME in $AWS_DEFAULT_REGION..."
 
+# Note that the AWS account being used to run this command needs to have certain permissions.
+# See https://eksctl.io/usage/minimum-iam-policies/ for permissions.
 # See https://eksctl.io/usage/schema/ for documentation of this yaml.
 cat <<EOF | eksctl create cluster -f - --kubeconfig "$ADMIN_KUBECONFIG" --profile service-account
 apiVersion: eksctl.io/v1alpha5