oh, that's cool, I didn't know that was possible. That said, I still think it's overkill and doesn't bring any real benefit? Sure you're reducing the blast rad

oh, that's cool, I didn't know that was possible. That said, I still think it's overkill and doesn't bring any real benefit? Sure you're reducing the blast radius of a security breach, but are the overcomplications worth it? Also, you now have to manage multiple accounts with multiple policies and users / roles, won't that extra complexity actually increase the attack surface?