code: def construct_policy(app='coreforrest', env='dev', group='forrest', region='us-east-1', pipeline_settings=None):
      
      LOG.info('Create custom IAM Policy for %s.', app)
  
      services = pipeline_settings.get('services', {})
      LOG.debug('Found requested services: %s', services)
  
      services = auto_service(pipeline_settings=pipeline_settings, services=services)
  
      if services:
          credential = get_env_credential(env=env)
          account_number = credential['accountId']
  
      statements = []
      for service, value in services.items():
          if value is True:
              items = []
          elif isinstance(value, str):
              items = [value]
          else:
              items = value
  
          rendered_statements = render_policy_template(
              account_number=account_number,
              app=app,
              env=env,
              group=group,
              items=items,
              pipeline_settings=pipeline_settings,
              region=region,
              service=service)
  
          statements.extend(rendered_statements)
  
      if statements:
          policy_json = get_template('infrastructure/iam/wrapper.json.j2', statements=json.dumps(statements))
      else:
          LOG.info('No services defined for %s.', app)
          policy_json = None
  
      return policy_json
docs: Assemble IAM Policy for _app_.
  
      Args:
          app (str): Name of Spinnaker Application.
          env (str): Environment/Account in AWS
          group (str):A Application group/namespace
          region (str): AWS region
          pipeline_settings (dict): Settings from *pipeline.json*.
  
      Returns:
          json: Custom IAM Policy for _app_.
          None: When no *services* have been defined in *pipeline.json*.