added second clause for IAM roles