AWS IAM Roles, a tale of unnecessary complexity
The author was doing the right thing with explaining it only makes sense when you know the history of how we got to where we are - but there is a bit more to it. It is all a series of band-aids. Band-aids all the way down. As somebody who has been involved with AWS since 2012 I&#x27;ve seen them all get added incrementally in response to explosions in usage and complexity and customer unhappiness and frustration.<p>Explicit allows being all you can do in an IAM policy were easy(ish) when there was a handful of AWS services and API actions. As there were more and more services and policy actions etc. they became unwieldy. Enter Permission Boundaries where you could wrap a few explicit denies around them. Kubernetes RBAC is nearly at the same place and could now really use those too - but I digress.<p>Also, early on in my AWS journey, even two accounts (one non-prod and one prod) was only done half the time and viewed as a best practice to think about - people genrally just opened one AWS account. But when IAM wasn&#x27;t enough (i.e. there wasn&#x27;t enough granularity on the resources or the conditions exposed etc.) the answer became separate AWS accounts as the only, or at least the easiest, way enforce these authorization boundaries&#x2F;separations with a blunt instrument you could trust. It also helped to keep your bills straight before they would do things like break them down by Tag.<p>Then you often needed cross-account role assumptions to deal with the inevitable cases where things or people needed access between these accounts.<p>Then the explosion in AWS Accounts led to AWS Organizations to provision and manage them all. And it built in Service Control Policies and OUs as a tool&#x2F;layer to help further manage&#x2F;constrain IAM policies&#x2F;permissions (IAM policies, Permission Boundaries and SCPs now being in a venn diagram with each other these days).<p>But AWS Organizations managing heaps of accounts was also too painful to use and get right and so they brought in AWS Control Tower to help make setting up Organizations easier.<p>So, in short, this all makes sense when you understand the inability to totally rewrite&#x2F;refactor important complex systems used by customers (breaking backward compatibility) and instead trying to keep solving all the challenges with an steady stream of incremental band-aids that you can announce at re:Invent.