Depending on what settings you use for the amazon-chroot builder additional actions needs to be allowed in the IAM role for the aws instance.

This patch does not include an exhaustive list of all alternatives, but only the changes I needed to do to get stuff working for me.