document the AWS policy that allows the code to work