s3:check_sam_security: untangle assignment from statement