IAM policy roles attr requires a list