Need to know what permissions the IAM role uses

[rogermyung]

Our standard company roles work great with this plugin.
We have a custom IAM role that is meant to provide access to a few select resources in the production account.
When we use this role, the plugin does not download the credentials file. We have tried adding "sts:TagSession", but are unsure what else it might need.