Add Cloudwatch Log permissions to the roles.yml file like they are in sso-dashboard to support the use of the watchtower module.