iam role cloudformation example. They allow you to specify