Document LOCAL_MARKER_GROUP. (#55)

* Document LOCAL_MARKER_GROUP. Closes #51

* Better wording

Author: mvanbaak

README.md

@@ -94,11 +94,16 @@ one or more of the following lines:
 ASSUMEROLE="IAM-role-arn"                      # IAM Role ARN for multi account. See below for more info
 IAM_AUTHORIZED_GROUPS="GROUPNAMES"             # Comma seperated list of IAM groups to import
 SUDOERSGROUP="GROUPNAME"                       # IAM group that should have sudo access
+LOCAL_MARKER_GROUP="iam-synced-users"          # Dedicated UNIX group to mark imported users. Used for deleting removed IAM users
 LOCAL_GROUPS="GROUPNAMES"                      # Comma seperated list of UNIX groups to add the users in
 USERADD_PROGRAM="/usr/sbin/useradd"            # The useradd program to use. defaults to `/usr/sbin/useradd`
 USERADD_ARGS="--create-home --shell /bin/bash" # Arguments for the useradd program. defaults to `--create-home --shell /bin/bash`
 ```
 
+The LOCAL_MARKER_GROUP will be created if it does not exist. BEWARE: DO NOT add any manually created users
+to this group as they will be deleted in the next sync. This group is used by aws-ec2-ssh to keep track
+of what users were imported in the last run.
+
 ## Using a multi account strategy with a central IAM user account
 
 If you are using multiple AWS accounts you probably have one AWS account with all the IAM users (I will call it **users account**), and separate AWS accounts for your environments (I will call it **dev account**). Support for this is provided using the AssumeRole functionality in AWS.