So this is a great step forward but why does @awscloud make identity management so unnecessarily complex.