It does make it easier to create and change policies, and this increases your development velocity and hence the chance that youll dedicate enough time to secur

It does make it easier to create and change policies, and this increases your development velocity and hence the chance that youll dedicate enough time to security. Some of the higher level constructs apply smart rules. Eg adding a load balancer target adds restricted access rules. It's still hard to know what's been created and how everything is connected. I made a graph visualization tool that live updates from a Cloudformation file. It solved all my visibility and understanding issues. I plan to release it soon.