The best part of any new stack: Spending 4 days repeatedly destroying and creating it while you figure out a single god damn policy to add to the project at a time
I've gotten a lot better at it by being boneheaded about not giving up. By bashing my head into IAM, I've gotten pretty good at figuring out the right set of permissions, roles, etc for cross account stuff to work. It's definitely still a mess a shitty, slow feedback loop, but it's better to have security by default.