relying on IAM for permissions