iam_by_principals_additive = {
  "user:user1@example.com" = ["role1", "role2"]
  "user:user2@example.com" = ["role2", "role3"]
}