Noting the April 17 policy update now includes apprunner permissions. https://docs.aws.amazon.com/aws-managed-policy/latest/reference/ReadOnlyAccess.html