sample IAM role policy for aminator