we get to play some tricks in JS that make it harder to make that mistake (you can pass the actual

Role

object in and we grab the ARN from it)