Document IAM roles in readme