> The other thing I'd bet is that this person has never had to make sure their infrastructure can pass any kind of security questionnaire or compliance audit.

> The other thing I'd bet is that this person has never had to make sure their infrastructure can pass any kind of security questionnaire or compliance audit. Security audits are a big security theater more often than not, though. At my current workplace, I have to jump through several hoops to do certain things, but it doesn't change the fact that I (or some privileged service) am still the entity that is allowed to jump through all these hoops. I don't want to imply that IAM is necessarily bad, but it is complicated to understand and security is often negatively affected when there is friction involved. Then, processes are implemented that look secure, but they don't necessarily guarantee security and people find workarounds like sharing tokens, defeating the whole point of auditability.