The Federating with your AWS account recipe in Chapter 8, Security and Identity for some discussion around IAM roles