Document required IAM permissions

/closes #2