There are some IAM classes in @aws-cdk/core and that's confusing. All IAM classes like `PolicyDocument`, `ServicePrincipal` should be in @aws-cdk/iam.