title: Cloudformation for a kube2iam role
body: <p>I'm having trouble creating a role for kube2iam, everything seems to work fine I deploy the stack with the role and the pods spin up but whenever a pod tries to perform an authorized action (put an item into dynamo in this case) I get an error that the assumed role is not authorized. Here's the snippet that creates the role:</p>
  
  <pre><code>ServiceRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName:
        Ref: StackName
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
        - Effect: "Allow"
          Principal:
            Service:
            - "ec2.amazonaws.com"
          Action:
          - "sts:AssumeRole"
      Path: "/"
      Policies:
      - PolicyName:
          Ref: StackName
        PolicyDocument:
          Version: "2012-10-17"
          Statement:
            - Effect: "Allow"
              Action:
                - dynamodb:PutItem
              Resource:
                Fn::GetAtt: [Table, Arn]
  </code></pre>
  
  <p>The table is elsewhere in the same stack and deploys just fine. I deployed kube2iam via a helm chart</p>
  
  <p>The error I get is:</p>
  
  <pre><code>User: arn:aws:sts::&lt;BLAHBLAH&gt;:assumed-role/nodes.k8s.logint.cimpress.io/&lt;BLAHBLAH&gt; is not authorized to perform: dynamodb:PutItem on resource &lt;BLAHBLAH&gt;
  </code></pre>
  
  <p>I also tried this for the assume role:</p>
  
  <pre><code>- Effect: "Allow"
    Principal:
      AWS: "arn:aws:iam::&lt;BLAHBLAH&gt;:role/nodes.&lt;BLAHBLAH&gt;"
    Action:
      - "sts:AssumeRole"
  </code></pre>
  
  <p>I still get the same error</p>