🐛 aws: stop counting an unreadable IAM policy as MFA enforcement (#3510)