updated IAM policy template