add option to specify external id for IAM roles