IAM is the bane of my existance. I once had to delegate spot fleet request/launch capabilities to a third party... it took me two weeks just to figure out how to add all the right permissions to make that happen without giving too much extra power.