fix policy in bucket