ARN of IAM role that includes the permissions required to scan and add tags to the associated protected resource.