Looking at this example I see the bucket name is passed through to the task as an envrionment variable. Maybe pulumi able to use that as a signal that the task role will need access to that bucket? https://github.com/pulumi/examples/blob/master/cloud-js-thumbnailer/index.js