Mentioned to Eamon in call, IAM role definitions are not specified so required permissions are unclear