Configuring IAM policies in remote accounts