if you run on an ec2-instance, you probably don't have to specify -region
if you run on an ec2-instance and the instance is associated with an appropriate IAM Role, you probably don't have to specify -access-key-id & -secret-access-key
AWS IAM Policy
the credential provided manually or fetched automatically by IAM Role should have the policy that includes an action, 'cloudwatch:GetMetricStatistics'