Having multiple accounts as best practice has nothing to do with IAM being complex, it’s about organization and security.

Would you run all your workloads in a single account? A bit messy if you have tons of resources and people collaborating.

And what if this single account gets compromised?