Chapter 9. Assuming an AWS IAM role for a service account