[nerdjon]

I probably should have been more clear on that, it is very possible with Cloudtrail and Athena and I find myself doing that pretty regularly.

But there are also times that it is inconsistent at best especially when trying to look at some nested permission problem. More than a few times I have had to get on with AWS support because the actual error just was not in Cloudtrail anywhere. Or it is related to some service that doesnt log to Cloudtrail like s3 access.

Which kinda more my point was, it isnt IAM itself that is the problem.