IAM is never fun, even if you work with it a lot. You always end up forgetting something and, come security audit time, you find out that people have been creating tons of policies that are just like "s3::*"