I would like to see IAM as well, but I would say that the solution right now is using a seperate account and using AWS MFA:
A new account doesn't have all AWS services enabled by default, so the impact seems minimal to start with. Not sure if you can lock this down further as I haven't looked into it.
All in all this is not perfect, but "securer".