builder iam role needs to give access to the full bucket. No sub-folders. Reflect in sample policy