The InstanceRole for the CertificateNode in security/public_certs has administrative permissions: https://github.com/aws-samples/aws-hpc-recipes/blob/8410cf46b9bd4d3cbc04a75309fe5da1baf40d81/recipes/security/public_certs/assets/main.yaml#L100-L105 Presumably left-over from development?