Agreed with everything you said! IaC changes everything. Especially CDK. But IMO permission boundaries still have a place in certain cases. If you allow SREs

Agreed with everything you said! IaC changes everything. Especially CDK. But IMO permission boundaries still have a place in certain cases. If you allow SREs to login and poke around in the accounts, what will stop them from creating policies in ad hoc way? Yes you can make RO roles but these don’t always work the way they are advertised. But I totally agree with your approach otherwise and that’s a winner setup for us as well on several projects.