update docs to include IAM roles

website/source/docs/providers/aws/r/flow_log.html.markdown

@@ -13,11 +13,55 @@ interface, subnet, or VPC. Logs are sent to a CloudWatch Log Group.
 
 ```
 resource "aws_flow_log" "test_flow_log" {
+  # log_group_name needs to exist before hand
+  # until we have a CloudWatch Log Group Resource
   log_group_name = "tf-test-log-group"
-  iam_role_arn = "arn:aws:iam::470663696735:role/tf-test-cloud"
+	iam_role_arn = "${aws_iam_role.test_role.arn}"
   vpc_id = "${aws_vpc.default.id}"
   traffic_type = "ALL"
 }
+
+resource "aws_iam_role" "test_role" {
+    name = "test_role"
+    assume_role_policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Sid": "",
+      "Effect": "Allow",
+      "Principal": {
+        "Service": "vpc-flow-logs.amazonaws.com"
+      },
+      "Action": "sts:AssumeRole"
+    }
+  ]
+} 
+EOF
+}
+
+resource "aws_iam_role_policy" "test_policy" {
+    name = "test_policy"
+    role = "${aws_iam_role.test_role.id}"
+    policy = <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Action": [
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents",
+        "logs:DescribeLogGroups",
+        "logs:DescribeLogStreams"
+      ],
+      "Effect": "Allow",
+      "Resource": "*"
+    }
+  ]
+}   
+EOF
+}
 ```
 
 ## Argument Reference