I disagree. IAM does what it’s supposed too when you need to run an organization with very fine gained controls.

People being able to see and interact with certain services but not everything related to those services. Same with services since it’s the same system.

To me the problem isn’t IAM itself but the nested API calls. Which also itself isn’t a problem but we need a better UI to diagnose when something goes wrong.

Cloudtrail isn’t really suitable for this task. A “simple” UI of looking at a role and seeing a “failed calls” would go a long way.