You should be deleting IAM identities you do not use. At the source, not just from the password manager but actually deleting the accounts/secret keys/passwords

You should be deleting IAM identities you do not use. At the source, not just from the password manager but actually deleting the accounts/secret keys/passwords/whatever. Also AWS isn't exactly for "reasonable ordinary people", it's a tool that requires some minimum amount of training. Yes the concept isn't super widely used for end user applications (although 1Password is a good example of another such "you have an account on an instance, that is unrelated to your account with the same email on another instance" concept). And yeah I do wish password managers would handle that better, but for anything that uses subdomain-level separation (example.1password.com vs amazon's signin.aws.amazon.com with multiple fields), it generally works out fine.