change IAM resource enablement to be based on username=='admin' again, but retain separate variables