how to set IAM permissions for REST API