Quick question - what other additional IAM permissions do we need beyond the ones from the template? Seems like AWS Batch is having trouble downloading the code package. I also tried adding s3 + kms policies for the

ecs_execution_role

but that didn't seem to work.