How else do you expect to manage permissions? Is there a better dsl design you have in mind?

What is better? I am pretty sure IAM is the best there is, no questions about that.

Better for small teams? Sure: a login/password system with maybe optional restrictions on services and maybe "readonly" access and maybe with disabled aws console.

Basically, something that was in AWS before the IAM madness came in.

But you can do that with IAM, and quite easily too

Create IAM user with access/secret keys are easy

Assign the built-in ReadOnly policy, easy too, or any other built-in "generic" policy

You are missing my point.

Of course, it is possible with IAM because IAM is a top-tier ACL system.

The point: I don't want to learn it.

If my account has only got one thing in it, I don’t expect to manage permissions at all.

“Everything has root” is fine when you are starting a new thing - what’s needed is tooling to start there and grow into fine grained permissions when you add a second thing.