Update README.md

Author: qoomon

README.md

@@ -47,8 +47,8 @@ ssh <INSTACEC_USER>@<INSTANCE_ID> \
 ```
 
 ## Alternative Implementation with `ec2-instance-connect`
-The advantage from security perspective it that you don't need to grant `ssm:SendCommand` to users and there by the permission to execute everything.
-Instead you only grant`ec2-instance-connect:SendSSHPublicKey` permission.
+The advantage from security perspective it that you don't need to grant `ssm:SendCommand` to users and there by the permission to execute everything as root.
+Instead you only grant`ec2-instance-connect:SendSSHPublicKey` permission to a specific instance user e.g. `ec2-user`.
 * Ensure [Prerequisits](#prerequisits)
 * Use this [aws-ssm-ec2-proxy-command.sh](ec2-instance-connect/aws-ssm-ec2-proxy-command.sh) proxy command script instead
 * Use this [IAM Policy Example](ec2-instance-connect/aws-ssm-ec2-iam-policy.json) instead