better to use an intersection and the wildcard, but that's how we do it in the Google IAM blog post