I find IAM particularly difficult to use - I feel like there should be a button to create a user&#x2F;group that can do only X, Y, Z. I realise policy templates get most of the way there but I still had to go and read the syntax for them because DescribeRegions wasn&#x27;t in the list I needed.<p>I&#x27;m also not sure how to make the jump from exporting AWS_ACCESS_KEY_ID and having my instances automatically request the permissions they need - STS?