COOK-3467: support IAM role