My issue is that most of the examples in the documentation either have or assume lax IAM policies.