IAM role created by S3A DT doesn't include DynamoDB scan

You can't run s3guard prune with role DTs as we don't create it with permissons to do so.

I think it may actually be useful to have an option where we don't restrict the role. This doesn't just help with debugging, it would let things like SQS integration pick up the creds from S3A.