Mostly annoying network configs and token expirations etc. Not saying it can't be set up well, but in my experience some security guru gets a hardon for making my life miserable.
Now if all your AWS accounts are only public facing then yes it can get a bit more complicated .