1. Craft perfect IAM policy 2. Deploy 3. Start typing random crap to try to fix it 4. "*" @awscloud There has to be a better way