A better approach is simply not to grant normal users modify access to IAM, VPC, or anything else potentially destructive, and force them to make all changes vi

A better approach is simply not to grant normal users modify access to IAM, VPC, or anything else potentially destructive, and force them to make all changes via a ci/cd pipeline with ops/sre oversight and review.