[staticassertion]

That's true. It's also true that AWS's IAM system is pretty complex and not incredibly well designed. AWS internally makes mistakes with it with some regularity.