I feel like IAM is not actually that complicated? Most services have permissions that are in direct correspondence with the API calls you want to make. Of course a few of them decided to do mad shit (looking at you API Gateway), and a few others require you to have nearly all permissions to do some of their most common API calls (S3 needs like 15 permissions to set all possible properies on an S3 object).

It’d be nice if AWS could fix the madness and standardize on one List/Update/Create/Delete call per resource, since most services are already like that.