put the IAM role to probe into a variable, since it could vary
builder iam role needs to give access to the full bucket. No sub-folders. Reflect in sample policy