PolicyArns are optional. Up to 10 managed policy ARNs can be provided. You must set either an inline Policy or managed policies using PolicyArns for this operation. If you do not set either Policy or PolicyArns the resulting credentials have no permissions.