Lobsters is a community-driven platform for sharing and discussing links to articles, tutorials, and projects related to technology and programming. Readers can learn about a wide range of topics, from software development and system administration to cybersecurity and artificial intelligence. With user submissions, comments, and voting, Lobsters provides a platform for collaborative learning and knowledge sharing among technology enthusiasts.

Lobsters

IAM in cloud providers has become increasingly complex and difficult to manage, causing challenges for users. GCP's approach to IAM is criticized for its folder structure and reliance on predefined roles. The solution proposed is to use service accounts and viewer accounts to track and adjust permissions based on actual usage.

IAM Is The Worst

At the very first I saw the heading like you are saying - “I AM THE WORST”. That feeling returned back to me. :(

This post was a rollercoaster ride to someone who is new to IAM lol

While I understand the sentiment, having fine-grained access control with explicit denies is a wonderful security tool.
Where IAM falls short is having a lack of direct mappings between the task you want users to be able to perform and the exact permissions required to perform that task.
You may immediately think, well, just add roles? Yes, having defined roles helps, however, it comes back to the same problem identified in this article. What if you want to build a new application with new permissions, you need to find out what permissions are used again. While developing in ECS or some other cloud-based service with lack of visibility, it can be difficult to truly understand what permissions are required for each task.
Also, by default, IAM only allows 10 managed policies per user / role. Which means you will either need to increase quota on the account or you better start writing inline policies.
Coming back full circle on this, IAM is actually the worst.