Fix IAM policy.