Ah, that’s the issue, at least for me - IAM roles are pretty nuanced, and it’s difficult to understand all that’s happening. I’m working extensively with Event

Ah, that’s the issue, at least for me - IAM roles are pretty nuanced, and it’s difficult to understand all that’s happening. I’m working extensively with EventBridge now, and their “security” docs mix “what can access EventBridge” with “what EventBridge can access”. Also, different AWS services all seem to have different requirements - e.g, some are role-based, some are service-based, and some are resource-based. It gets complicated very quickly.