As an administrator, my overall experience with AWS IAM has been very positive. This service provides a full framework for controlling access to resources across the AWS ecosystem. It allows me to define granular permission, manage identities, and enfore the least-priviledge access to the users, roles, and services. From an operational standpoint, IAM is to secure cloud workloads and ensuring that access to critical resources is always tight.

there's too much complexity and granularity to drafting policies. The default managed policies are too open and makes security as a default difficult to achieve. There should be a resource policy simulator in addition to the existing policy simulator.