Thanks for sharing this perspective. AWS IAM does have resource condition keys which allow matching resources by account, org, org path, and tag. Resources in

Thanks for sharing this perspective. AWS IAM does have resource condition keys which allow matching resources by account, org, org path, and tag. Resources in a Cloudformation stack would be automatically tagged, for example. https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_p...