I have been discussing IAM with a couple of AWS engineers from that team a few years ago. I have tried to convince them to implement something actually sane non-corporate developers, because IAM is complicated way beyond a point of being usable. I have seen so many people just slam the root credentials into config in order to never touch IAM. And yes, me included, and yes, it's a shameful practice, don't do that. Take a day off, go on a hike, watch the sunset, meditate and embrace the inevitable: yes IAM is incredibly bad and there is no way around.
(I was heavily using AWS since inception, way before IAM was invented).
My speech fell on deaf ears, because IAM is clear as sky to its inventors and they fail to see what's the problem in it and corporate customers are happy to employ one or two people solely dedicated to learning and managing IAM.
Anyways. There is no way around IAM. And just like with systemd you better embrace it and learn it and it turns not that terrible.
(I was heavily using AWS since inception, way before IAM was invented).
My speech fell on deaf ears, because IAM is clear as sky to its inventors and they fail to see what's the problem in it and corporate customers are happy to employ one or two people solely dedicated to learning and managing IAM.
Anyways. There is no way around IAM. And just like with systemd you better embrace it and learn it and it turns not that terrible.