IAM. In GCP you can create a project and give pretty indiscriminate permissions between entities at the project level. It's not the hardest posture in the worl

IAM. In GCP you can create a project and give pretty indiscriminate permissions between entities at the project level. It's not the hardest posture in the world, but as long as the project is fine-grained and the stakes aren't too high, it's reasonable. In AWS it seems you are stuck managing ARNs for every damn object if you want to have anything less than a free-for-all in the account. This is an incredibly intense level of bureaucracy. I can see how the project abstraction could break down for a proper enterprise, which might really need that arbitrarily complex spaghetti of individual objects connected to individual objects. But it would still be better if the default or happy-path approach favored the better engineering practice of self-contained systems connected over few and well-defined interfaces.