# AWS IAM Hacker Approved page: https://hackerapproved.com/p/aws-iam/ 13 people recommended AWS IAM in Hacker News comments, 3 had mixed feelings and 24 criticized it, November 2025 to October 2026. It was recommended in 5 of 12 months, in 7 threads. It does not meet the Hacker Approved badge rule. **Verdict:** Criticized more than recommended: the most common complaint is that it has grown complicated and inconsistent across services; those who recommend it cite fine-grained, JSON-policy access control that many find well designed and easy to get started with. Summary written by Claude from the comments below. ## What people warn about - Complex and tedious to configure (6 comments in the sample): "having to iterate, one at a time, through the five hundred and thirty seven new permissions you need to grant" ([source](https://news.ycombinator.com/item?id=48089053)) "IAM is unnecessarily bad. I recently had to set a trivial policy, and was doing it correctly." ([source](https://news.ycombinator.com/item?id=48085749)) "imposing worst-case complexity on the 99% of people who will never benefit" ([source](https://news.ycombinator.com/item?id=48089012)) - Grew organically into a mess (4 comments in the sample): "the system actually makes sense in anything other than an agglomeration-of-backwards-compatible-layers sense" ([source](https://news.ycombinator.com/item?id=48090567)) "+1 on the IAM over engineering, though to AWS credit, I suspect it was evolved rather than design" ([source](https://news.ycombinator.com/item?id=48083714)) "Like you said with IAM, I think it just slowly evolved into the mess it is today" ([source](https://news.ycombinator.com/item?id=48086968)) - Hard to predict or audit (3 comments in the sample): "With IAM it's more like "I'm pretty sure I figured out the right silly-walk for X…" ([source](https://news.ycombinator.com/item?id=48091482)) "fundamentally it is one input into a huge mess that you cannot actually see or audit from a 10k foot level" ([source](https://news.ycombinator.com/item?id=48086754)) "I’m not convinced that anyone knows how IAM rules and policy rules interact." ([source](https://news.ycombinator.com/item?id=48084245)) - Regional outage breaks everything (2 comments in the sample): "If the IAM in us-east-1 goes down, every non-public object or workload that needs any kind of AWS authentication will fail immediately." ([source](https://news.ycombinator.com/item?id=46689937)) "some services fail to achieve the "static stability" you describe" ([source](https://news.ycombinator.com/item?id=48078355)) ## Why people recommend it - Fine-grained, logical access control (3 comments in the sample): "IAM comes to mind, with fine grained control over everything." ([source](https://news.ycombinator.com/item?id=47242540)) "AWS, GCP, and Azure handle fine-grained access well." ([source](https://news.ycombinator.com/item?id=46861811)) "IAM is I think good, logical and granular enough." ([source](https://news.ycombinator.com/item?id=48085560)) - Simple JSON policy documents (3 comments in the sample): "It's literally a JSON policy document." ([source](https://news.ycombinator.com/item?id=48087969)) "So much easier to use IAM policies." ([source](https://news.ycombinator.com/item?id=48084671)) "I've always found AWS IAM quite simple, but then again it is my job" ([source](https://news.ycombinator.com/item?id=45818190)) - Better than other clouds' systems (2 comments in the sample): "AWS IAM is extremely well designed when you compare it with the spaghetti monster IAM systems of other clouds" ([source](https://news.ycombinator.com/item?id=48083925)) "IAM is a better set of semantics for securing your infrastructure" ([source](https://news.ycombinator.com/item?id=45910511)) - Easy to grasp the basics (2 comments in the sample): "It's complex but still easily understandable to get the basics." ([source](https://news.ycombinator.com/item?id=48091843)) "it's straightforward to say e.g. "permit traffic on port X from instances holding IAM role Y" ([source](https://news.ycombinator.com/item?id=47242368)) ## Where to get it - [Visit the official site](https://aws.amazon.com/iam/) ## The badge A product earns the Hacker Approved badge when at least 10 people recommend it, recommenders outnumber critics at least 2 to 1 (mixed feelings count toward neither side), it was recommended in at least 4 of the 12 months and in at least 5 different threads, and no single thread supplies more than half of the people who recommend it. Health and money products are never badged. ## Cite as Hacker Approved, "AWS IAM", https://hackerapproved.com/p/aws-iam/ (13 recommend, 3 mixed, 24 criticize; Hacker News comments, November 2025 to October 2026). Counts updated 3 Nov 2026, with data through October 31, 2026.