Parts of this that I don't think we can/want to automate

• VPC (already made in default account)
• subnet (see above)
• ssh key (the person should do that separately)

Parts of this we may want to automate

• Role creation for both roles
• Dead letter queue creation
• Bucket creation maybe?
  • This would be nice because we could set one up with the right permissions for logging, could pre-set up nice bucket defaults like versioning on, old versions being deleted, intelligent tiering being set up, but I'm not sure if we should enforce this