if I understand correctly, the author is an infosec auditor who reviews security of those aws/gcp setups for their job? Then their job is the opposite of an engineer: the engineer is desperately trying to get shit done without managing IAM madness fulltime (hence admin admin everything), an auditor cannot give two craps about usability on the other hand, and will try to impose an idealistic model of perfectly tuned, strictly as-needed-basis permissions with no regard to how much time it would take to work them out in practice, and to maintain, because that's not their job.