fixed IAM policy