It doesn't help that AWS IAM is often confusing and inconsistent. And some permissions that should have resource-level granularity and/or support conditions, do

It doesn't help that AWS IAM is often confusing and inconsistent. And some permissions that should have resource-level granularity and/or support conditions, don't. To be fair, this does seem to be improving somewhat, but even some newer permissions aren't able to be controlled in as granular a way as I would like.