Can you log the exception ?

We didn't do it in the first step because it was enabled by default and if IAM is not available for everyone but now that it's disabled by default, we can expect people to have IAM enabled.