It still does not understand boolean logic in IAM especially when you have Not conditions.