And when you use a role like this, you really should use an external ID to avoid confused deputy attacks.

http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_cre...