~$ aws iam create-role --role-name use-s3 \
   --assume-role-policy-document '{
  "Version": "2012-10-17",
  "Statement": [ {
    "Effect": "Allow",
    "Principal": { "Service": "ec2.amazonaws.com" },
    "Action": "sts:AssumeRole"
    } ]
}'

~$ aws iam attach-role-policy --role-name use-s3 \
   --policy-arn arn:aws:iam::aws:policy/AmazonS3FullAccess
