update example role, move config step for cloudwatch
ship important logs to cloudwatch