> and there's no automated tool that will automagically sense the AWS API calls that you perform and then write them for you in a least-privilege manner.

Netflix released one two years ago: https://medium.com/netflix-techblog/introducing-aardvark-and...