thanks @jarens, I may start there, likely get a role defined that I like and save it in the SDF for easy deployment to other accounts