apply auto-generated access policy to IAM Group