updated policies to reflect whats needed from the cloudwatch additions in #70