Cloudformation: allow access to dynamo db too