However, I could imagine a use case wherein you need to provide a user with a small, locked down set of permissions to your AWS account. If that were the case, you could spin up a jump host with an IAM role that guarantees they're only capable of doing exactly what you allow them to do.