Add AWS profile config and resoftware-iac OpenTofu state runbook

Track ~/.aws/config (profiles only, never credentials) as a copied
config: setup.sh restores it, update.fish refreshes it. Document the
S3 state backend setup for resoftware-iac in the README, including
the config/credentials profile-header gotcha behind "failed to get
shared config profile".

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

README.md

@@ -8,7 +8,7 @@ Two kinds of files live here:
 - **Symlinked** — the file in this repo *is* the live config (fish, starship, ssh,
   kube, npm, NuGet). Edit either side, they're the same file.
 - **Copied** — files that can't be symlinked (`/etc/hosts`, Claude/Serena settings,
-  the brewfile). Refresh them from the machine with `./update.fish`.
+  the AWS config, the brewfile). Refresh them from the machine with `./update.fish`.
 
 ## Fresh machine setup — the fast way
 
@@ -84,12 +84,16 @@ ln -sf $(pwd)/NuGet.Config     ~/.nuget/NuGet/NuGet.Config
 ### 6. Restore the copied configs
 
 ```bash
-mkdir -p ~/.claude ~/.serena
+mkdir -p ~/.claude ~/.serena ~/.aws
 cp claude-settings.json ~/.claude/settings.json
 cp serena_config.yml    ~/.serena/serena_config.yml
+cp aws-config           ~/.aws/config
 sudo cp hosts /etc/hosts
 ```
 
+(`aws-config` only holds profile definitions — the actual AWS credentials are
+set up later, in the "AWS + OpenTofu state access" step.)
+
 ### 7. Set fish as the default shell
 
 ```bash
@@ -123,13 +127,57 @@ Clones every repo in the `resoftware` GitHub org via SSH into
 `~/Repositories/{customer-number}/{repo-name}`, based on each repo's
 `customer-number` custom property. Safe to re-run — existing clones are skipped.
 
-### 11. WireGuard tunnel to home network (optional)
+### 11. AWS + OpenTofu state access (resoftware-iac)
+
+All OpenTofu state for `resoftware-iac` lives in the S3 bucket
+`resoftware-iac-state` (eu-north-1); the backend blocks in that repo reference
+the `resoftware-iac` AWS profile, so `tofu init` fails with *"failed to get
+shared config profile resoftware-iac"* until that profile exists.
+
+The `aws-config` restored in step 6 already defines both profiles in
+`~/.aws/config`:
+
+- `resoftware-iac` — the `iac` IAM user; used for the S3 state backend and plans.
+- `default` — a root login session (account 693091788121); used for applies via
+  `aws configure export-credentials`.
+
+What can't live in git and must be set up by hand:
+
+```bash
+aws configure --profile resoftware-iac
+```
+
+Enter the `iac` user's access key (from 1Password or the old machine's
+`~/.aws/credentials`; or mint a fresh key in the AWS console — IAM is
+deliberately console-managed, not IaC) and region `eu-north-1`. Beware if
+editing the files manually instead: `~/.aws/config` section headers carry a
+`profile ` prefix (`[profile resoftware-iac]`) but `~/.aws/credentials` headers
+do **not** (`[resoftware-iac]`) — mismatching them causes exactly the
+"failed to get shared config profile" error. `aws configure` writes both
+correctly.
+
+For applies, also establish the root session once:
+
+```bash
+aws login
+```
+
+Then restore each stack's gitignored `terraform.tfvars` (Infisical
+machine-identity creds — copy securely from the old machine or refill from
+Infisical; currently only `infra/cloudflare/terraform.tfvars`), and verify:
+
+```bash
+aws sts get-caller-identity --profile resoftware-iac
+cd ~/Repositories/kl0000/resoftware-iac/infra/cloudflare && tofu init
+```
+
+### 12. WireGuard tunnel to home network (optional)
 
 `meerkoet-proxy.conf` is a WireGuard client config for the home (Fritz!Box)
 network. Import it into the WireGuard app (installable from the App Store) via
 **Import Tunnel(s) from File**.
 
-### 12. Manual leftovers
+### 13. Manual leftovers
 
 Things not automated here:
 
@@ -147,5 +195,6 @@ The symlinked files are always current by construction. Refresh the copied ones
 ```
 
 It re-dumps the brewfile (`brew bundle dump --force`) and re-copies
-`~/.claude/settings.json`, `~/.serena/serena_config.yml`, and `/etc/hosts` into
-the repo. Review `git diff` afterwards and commit.
+`~/.claude/settings.json`, `~/.serena/serena_config.yml`, `~/.aws/config`, and
+`/etc/hosts` into the repo. Review `git diff` afterwards and commit.
+(`~/.aws/credentials` is never tracked.)