Essentially every large scale environment I’ve seen (as an ex-core maintainer of Terraform, that is quite a few) either does an ok job of this or has projects to do better.
The issue I have with IAM is that it is not possible to be sufficiently fine grained - for example I cannot grant an instance permission to read its own tag values but not those of other instances, since the EC2 IAM API is stuck in the state of 85% done at which most AWS services eventually seem to plateau.
I almost mentioned IAM in my post as a co-killer-feature, but I've only ever witnessed its power in AWS learning material / conferences, not being leveraged IRL, so I decided not to speculate. I'm more dev than ops, so even though I've seen a decent number of AWS environments the fact that they have all used IAM in a clumsy, coarse manner doesn't really mean much.
Do you have a feel for how frequently ops manages to actually leverage the fine-grained power features in IAM?