Initial design for IAM policy update with image/AZ restrictions