in event of removing user, script should set trusted relationship on existing roles based on the new user's ARN