[tyingq]

I'm curious if the tooling could be made to work with a "default deny" policy, that is, is there enough info to generate the IAM policies when you get "permission denied"?