It's a real problem. AWS IAM permissions are not human manageable anymore. The only way to get decent permissioning done is via an IaC abstraction layer that can generate them for you based on declared needs. AWS CDK does a pretty decent job here at making it so you can just say `myTable.grantRead(myLambda)`. A lot of the higher level constructs take care of transitive permissions that are needed. Even then, there are cases where you need to make sure you don't just do `myBucket.grantRead(thing)` but also `myEncryptionKey.grantDecrypt(thing)`.

Doing fine-grained permissions correctly is hard.