OAuth 2.0 scopes and IAM roles