Minimizing AWS permissions to just the set you need can be a royal pain in the ass. Many of the canned AWS-managed example policies end up giving either ANY ac

Minimizing AWS permissions to just the set you need can be a royal pain in the ass. Many of the canned AWS-managed example policies end up giving either ANY action on a resource, or grant a handful of actions on ANY resource, (e.g. grant S3:* on some bucket, which inadvertently lets you delete the bucket too) Simply reading the docs and attempting to divine the right subset of permissions can be nearly impossible. Usually you must guess, then exercise the software until it fails, then look in CloudTrail to see which permissions got denied, then try a new covering set, and repeat until nothing breaks. To say this is frustrating would be an understatement.