One IAM table aka AWS subaccount, or in GCP another "project", for one app or small collection of apps that go together is the right approach in most cases. Yes.