3 ms·
OP here. You _can_ do this but IAM Policy wise it is a mess and not very maintainable. You end up needing to constantly grant and revoke access to individual r
by ejcx 9y ago
OP here. You _can_ do this but IAM Policy wise it is a mess and not very maintainable.
You end up needing to constantly grant and revoke access to individual resources if you went this route. Instead, it's nice to give engineers access to everything that's in their account, and not worry about IAM policies.
- erik_seaberg 9y agoReally the problem is that IAM is not a capability system. If you can write a policy at all, there are no limits on what you can put in it, so we can only let trusted admins touch policies. An engineer should be able to grant some of their own privileges to the things they run.