code: function buildBastionIamRole({ name = 'BastionIamRole' } = {}) {
    return {
      [name]: {
        Type: 'AWS::IAM::Role',
        Properties: {
          AssumeRolePolicyDocument: {
            Statement: [
              {
                Effect: 'Allow',
                Principal: {
                  Service: 'ec2.amazonaws.com',
                },
                Action: 'sts:AssumeRole',
              },
            ],
          },
          Policies: [
            {
              PolicyName: 'AllowEIPAssociation',
              PolicyDocument: {
                Version: '2012-10-17',
                Statement: [
                  {
                    Action: 'ec2:AssociateAddress',
                    Resource: '*',
                    Effect: 'Allow',
                  },
                ],
              },
            },
          ],
          ManagedPolicyArns: ['arn:aws:iam::aws:policy/service-role/AmazonEC2RoleforSSM'],
        },
      },
    };
  }
docs: Build an IAM role for the bastion host
  
  @param {Object} params
  @return {Object}