I'm not sure how IAM is any more difficult or harder to comprehend than any alternative. I've been using AWS since 2010 and frankly IAM has never been an issue.

I'm not sure how IAM is any more difficult or harder to comprehend than any alternative. I've been using AWS since 2010 and frankly IAM has never been an issue. Can you give some examples? In any case, IAM and its essential features are not some optional thing; it's actually the prerequisite for AWS existing in its current form. IAM is the most universal AWS service - every other AWS service must use it. It's a loosely coupled symbolic policy computation engine for federated identity and service permissions. The "federated" part is doing A LOT of heavy lifting here: without federation, it's impossible to decouple teams and achieve the organizational velocity that AWS has. Other cloud providers have ended up re-inventing AWS IAM, sometimes poorly. Although I have to give GCP credit for recently greatly improving their IAM console and permissions error usability.