To be fair I also really struggle with AWS IAM policies and I'm a pretty senior engineer with a lot of experience.