Even the "easy" services like that have at least _some_ barrier to entry. IAM alone is a pretty big beast and I doubt someone whose never used AWS would grasp it their very first time logging into the web interface - and every service uses it extensively.

And then there's the question of whether you're going to use Terraform, Ansible, CloudFormation, etc or click through the GUI to manage things.

My point is, nothing in AWS is 100% turnkey like a lot of folks pretend it is. Most of the time, it's leadership that thinks since AWS is "Cloud" that it's as simple as put in your credit card and you're done.

IAM is absolutely NOT something you can just ignore unless you have a huge pile of cash to burn when your shit gets compromised.

I worked at a startup, hosted on AWS, that was deployed before EC2 IAM roles were a thing. We had the same AWS access key credentials deployed on every machine. Whenever an employee left, we had to rotate them all.. Fun times.

You absolutely need IAM immediately, if you have any services talking to any other services.

You _should_ use IaC immediately as well, because the longer you delay, the more it's going to hurt when you finally do need it.

There are companies earning money by showing other companies how to reduce their AWS bill.