AWS prives required aren't documented

Using ansible to deploy AWS instances, but each time more privs need granted that I would expect. Does anyone know what privs are required for this operation?

  • name: Launch instance
    local_action:
    ec2 keypair=
    group=
    instance_profile_name=
    instance_type=
    image=
    region=
    wait=yes
    count=
    register: ec2launched

Thanks!