IAM is hideous; users, organisations and policies are a barouque mess, where you're expected to hand-edit JSON files specifying resources then debug the cryptic

IAM is hideous; users, organisations and policies are a barouque mess, where you're expected to hand-edit JSON files specifying resources then debug the cryptic error messages thrown when their own examples are pasted in. Plus the documentation is out of date in so many places, describing actions to take that have long since changed. It's ok for single users (simple single-user use cases) and large organisations that can afford to allocate the time and effort to administer the thing; anywhere in between is a just-say-no. (ranting a bit because I just lost the whole morning adding a policy to allow a single user to do a limited set of things).