Print a nicer error when IAM policy parsing fails

Addresses TOOLS-396