Need to know what permissions the IAM role uses

[rogermyung]

Our standard company roles work great with this plugin. We have a custom IAM role that is meant to provide access to a few select resources in the production account. When we use this role, the plugin does not download the credentials file. We have tried adding "sts:TagSession", but are unsure what else it might need.