There are dozens upon dozens of companies doing exactly this sort of service for AWS. And they all use the describe API calls requiring IAM permissions.