Comment by w1nt3rmut3

They do and there is even a button in iam to do just that. Also exposed as api to regernate the policy based on usage.