applied correct IAM policy