What role should I assign to an EC2 instance to allow it to assign an Elastic IP to itself with a bootstrap script?

I am working on a cloudformation file where an EC2 instance has to get EIP during the first boot. To do that I think I need to assign a role to it, which allows the instance to get EIP. Could you tell me what kind of permissions policies it needs, I don't want to give the instance extra rights?

Best regards