ensure IAM isn't accidentally read during unit tests