Agreed, there is a large learning curve and it took me a long time to wrap my head around it. It requires a lot of knowledge and discipline, which sooner or la

Agreed, there is a large learning curve and it took me a long time to wrap my head around it. It requires a lot of knowledge and discipline, which sooner or later will create holes. For example, if you need to pass a role to a service, you'll need PassRole; if you grant it on " * ", then oops, you might have just created the opportunity for privilege escalation [1]. There's also probably issues specific to your company: allowing access to read resource foo in general is not an issue, except your specific company stores sensitive data there. If every developer is expected to be a security expert, the security risks increase, and the productivity overhead may even be worse than having a dedicated security/IAM team that gatekeeps permissions. [1] https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/ https://rhinosecuritylabs.com/aws/aws-privilege-escalation-m...