diff --git a/docs/modules/ROOT/partials/exoscale/environment-vars.adoc b/docs/modules/ROOT/partials/exoscale/environment-vars.adoc
index fe71b821..a386b3de 100644
--- a/docs/modules/ROOT/partials/exoscale/environment-vars.adoc
+++ b/docs/modules/ROOT/partials/exoscale/environment-vars.adoc
@@ -1,9 +1,10 @@
 .Access to cloud API
 [source,bash]
 ----
-export EXOSCALE_API_KEY=<exoscale-key>
+export EXOSCALE_API_KEY=<exoscale-key> <1>
 export EXOSCALE_API_SECRET=<exoscale-secret>
 export EXOSCALE_ZONE=<exoscale-zone> <1>
 export EXOSCALE_S3_ENDPOINT="sos-${EXOSCALE_ZONE}.exo.io"
 ----
-<1> All lower case. For example `ch-dk-2`.
+<1> We recommend setting up an IAMv3 role called `unrestricted` with "Default Service Strategy" set to `allow` if it doesn't exist yet.
+<2> All lower case. For example `ch-dk-2`.