Ask HN: Why is so hard to apply the least privilege principle in IAM accounts?

We all know that vulnerabilities are a concern in security, but IAM misconfigurations are actually the biggest culprit in cloud security incidents.

Why do we keep using "*" and then complain about it? Is IAM so challenging?