At my company I am working to get all of our IAM policies ironed out in AWS-CDK. Through this any developer can pull down the git repo containing the IAM roles.

At my company I am working to get all of our IAM policies ironed out in AWS-CDK. Through this any developer can pull down the git repo containing the IAM roles. They can makes changes and submit MRs but the only approvers of those MRs are part of our Access Management team. This all of the IAM roles can be crafted by the devs but must be explained and understood by the AM team through a code review process. After that automation takes over and then the policy can be referenced by other CDK/CF templates.