autosign example that uses IAM roles