> I've found IAM's power impressive but ultimately complex Honestly, as a not-a-security-guy, I can count on the fingers of one hand the number of times I've h

> I've found IAM's power impressive but ultimately complex Honestly, as a not-a-security-guy, I can count on the fingers of one hand the number of times I've had to learn something around security and it's been easy. > separate AWS accounts for each environment may well be the best way to do this A thousand times yes. There is so much to do in IAM, that it's just easier to let the devs have access to a 'test' account, and keep the 'prod' account out of their mitts.