s3-include: use new roles.h