Add setup documentation.

Freeze requirements into a pip requirements file.
The PyYAML dependency was inferred from import errors
at runtime.

Add basic setup instructions for a Python venv.

Add the venv from those instructions to .gitignore.

.gitignore

@@ -1 +1,2 @@
-iam_definition.json
+iam_definition.json
+venv/

README.md

@@ -23,6 +23,16 @@ The addition of an action to these lists can be subjective. Is a pull request in
 
 The script [policy-generation.py](scripts/policy-generation.py) allows you to customize your policies to an extent. If there are specific actions you want to exclude from the explicit deny, you can specify them using `--exclude-actions`. If there are a handful of resource ARNs that you need to access, say a specific S3 Bucket, you can use the `--exclude-resources` flag, and they will be added to the policy using a `NotResource` field.
 
+First, install the script's dependencies. A [Python venv](https://docs.python.org/3/library/venv.html) is an easy way:
+
+```bash
+python3 -m venv venv
+source venv/bin/activate
+pip install -r requirements.txt
+```
+
+Then you can run the script:
+
 ```bash
 usage: policy-generation.py [-h] [--debug] --risk {PrivEsc,ResourceExposure,CredentialExposure,DataAccess,ALL}
                             [--exclude-resources EXCLUDE_RESOURCES [EXCLUDE_RESOURCES ...]]

requirements.txt

@@ -0,0 +1 @@
+PyYAML==6.0.2