I've made it a habit to only create IAM roles/users/policies using CloudFormation. This way they can be easily removed, are version controlled and you can see why they were created in the first place.