[redserk]

I agree that this is what everyone should strive to do but this quickly hits a limit.

For example, IAM/S3/SQS policy evaluations can have profound impact on an application running but an abstraction wouldn’t help much here (assuming the developer is putting any thought into securing things). There just isn’t an alternative to these. If you’re rolling out an application using AWS-proprietary services, you have to get into vendor-specific functionality.

[dgxyz]

My point is you should not build on top of their native services if it incurs this problem.

[pas]

it's a trade off, a risk. (sure, for many people it doesn't make sense, because they don't have scale or growth anywhere near the numbers where generic/abstracted is not efficient enough)