ci: split aws credentials in two separate users with scoped perms

[emilyalbini]

This commit changes our CI to use two separate IAM users to authenticate with AWS:

• ci--rust-lang--rust--sccache: has access to the rust-lang-ci-sccache2 S3 bucket and its credentials are available during the whole build.
• ci--rust-lang--rust--upload: has access to the rust-lang-ci2 S3 bucket and its credentials are available just during the upload step.

The new tokens are available in the prod-credentials library.

r? @alexcrichton

[emilyalbini]

@rustbot modify labels: beta-nominated beta-accepted T-infra

Accepting this for beta backport on my own as if this is merged we're going to need the new credentials on beta as well.

[alexcrichton]

@bors: r+

[bors]

📌 Commit 00c44af has been approved by alexcrichton

[bors]

⌛ Testing commit 00c44af with merge ea6044e018d3eac7182b45406ceee95ece8f71bc...

[bors]

💔 Test failed - checks-azure

[rust-highfive]

Your PR failed (pretty log, raw log). Through arcane magic we have determined that the following fragments from the build log may contain information about the problem.

Click to expand the log.

2019-09-18T16:33:02.3158260Z [command]/bin/bash --noprofile --norc /home/vsts/work/_temp/aa213ad5-69d3-43d5-8f8e-5f82dc8d87de.sh
2019-09-18T16:33:02.3229971Z Cloning into 'rust-toolstate'...
2019-09-18T16:33:03.1059997Z <Nothing changed>
2019-09-18T16:33:03.3141365Z Traceback (most recent call last):
2019-09-18T16:33:03.3142319Z File "/home/vsts/work/1/s/src/tools/publish_toolstate.py", line 267, in <module>
2019-09-18T16:33:03.3142435Z validate_maintainers(repo, github_token)
2019-09-18T16:33:03.3142896Z File "/home/vsts/work/1/s/src/tools/publish_toolstate.py", line 73, in validate_maintainers
2019-09-18T16:33:03.3144083Z 'Accept': 'application/vnd.github.hellcat-preview+json',
2019-09-18T16:33:03.3144194Z File "/usr/lib/python2.7/urllib2.py", line 154, in urlopen
2019-09-18T16:33:03.3233991Z return opener.open(url, data, timeout)
2019-09-18T16:33:03.3234470Z File "/usr/lib/python2.7/urllib2.py", line 435, in open
2019-09-18T16:33:03.3234600Z response = meth(req, response)
2019-09-18T16:33:03.3234780Z File "/usr/lib/python2.7/urllib2.py", line 548, in http_response
2019-09-18T16:33:03.3235490Z 'http', request, response, code, msg, hdrs)
2019-09-18T16:33:03.3235616Z File "/usr/lib/python2.7/urllib2.py", line 473, in error
2019-09-18T16:33:03.3235750Z return self._call_chain(*args)
2019-09-18T16:33:03.3235835Z File "/usr/lib/python2.7/urllib2.py", line 407, in _call_chain
2019-09-18T16:33:03.3237885Z result = func(*args)
2019-09-18T16:33:03.3238204Z File "/usr/lib/python2.7/urllib2.py", line 556, in http_error_default
2019-09-18T16:33:03.3238853Z raise HTTPError(req.get_full_url(), code, msg, hdrs, fp)
2019-09-18T16:33:03.3241458Z urllib2.HTTPError: HTTP Error 401: Unauthorized
2019-09-18T16:33:03.3432349Z ##[error]Bash exited with code '1'.
2019-09-18T16:33:03.3478811Z ##[section]Starting: Upload CPU usage statistics
2019-09-18T16:33:03.3481676Z ==============================================================================
2019-09-18T16:33:03.3481759Z Task : Bash
2019-09-18T16:33:03.3481874Z Description : Run a Bash script on macOS, Linux, or Windows

I'm a bot! I can only do what humans tell me to, so if this was not helpful or you have suggestions for improvements, please ping or otherwise contact @TimNN. (Feature Requests)

[emilyalbini]

@bors retry

Copied the wrong GitHub token, woops! Updated the variable group on the Azure Pipelines side.

[Centril]

Failed in #64594 (comment), @bors r-

[emilyalbini]

@bors rollup=never

[emilyalbini]

Forgot to pass the new credentials to a step.

@bors r=alexcrichton rollup=never

[bors]

📌 Commit 5384a19 has been approved by alexcrichton

[emilyalbini]

@bors p=1 to get this into 1.39.

[bors]

⌛ Testing commit 5384a19 with merge ea3ba36...

[bors]

☀️ Test successful - checks-azure
Approved by: alexcrichton
Pushing ea3ba36 to master...