Ask HN: How do you manage your AWS IAM controls for AWS datacenter environments?

Especially around:

    - Providing development and test sandboxes  
    - Environment isolations  
    - Providing flexibility and control

In a way, provide PaaS on AWS to dev/qa and test folks.