Document the aws provider default_tags block (#174)

Author: ale210

terraform/backend.tf

@@ -3,6 +3,11 @@ terraform {
   }
 }
 
+// Region and profile come from the ambient environment at run time, not from here.
+// managed-by is deliberately distinct from incubator's "terraform-incubator": account
+// 035866691871 is written to by two Terraform states, and the tag says which one owns
+// a resource. IAM groups and policy attachments cannot be tagged by any AWS API, so
+// they carry no managed-by regardless of this block.
 provider "aws" {
   default_tags {
     tags = {