That has been my experience as well. I don't understand it well enough to say that it's more complicated than it needs to be, but it's certainly clear that there is no obvious on-ramp. Everything starts locked down, and opening up anything requires figuring out which of numerous options gives you what you need without inviting the entire universe in.

Usually, the best way to learn is by experimentation. But with security, your "experiments" might leave you exposed. Or at least, leave your system in some nonstandard state, making it even harder to figure out what the correct route was supposed to be.

It's why I've been happy to use things like netlify. They may not scale, but at least it feels like I can get a project up without it becoming an ordeal of opening permissions.

It's not my main line of work, and as you say, I imagine I would figure it out if I did it consistently for a bit. But every time I start a side project using AWS, IAM scares me off.