Document required IAM permissions

This closes #2.