IAM role that includes the permissions required to scan and (optionally) add tags to the associated protected resource.