Add note about IAM roles