Document required IAM permissions

This closes #4.