IAM policy I ended up with is here if anyone finds...
# aws
i
IAM policy I ended up with is here if anyone finds it useful: https://gist.github.com/mattfysh/1044cd7c4c99bd5aa06a684389e91f58