Funnily enough, have been working on that exact setup gripe this afternoon:

https://github.com/snowplow/snowplow/wiki/IAM-setup

(work in progress ;-)