- I am shocked that you don't seem to find Deny By Default the best thing in the world... (looking at you Azure...)
> You need deep understanding of each service's specific IAM setup.
- Color me shocked...
> Ancillary permission requirements are not obvious if you're not familiar with the details of how a service works.
- Imagine...Having to understand how stuff works to be gainfully employed....
> Permission related failures do not make the root cause immediately clear.
Cloudtrail is your friend...
> Secrets related permissions are especially tricky.
- Define the complaint....
> The out-of-the-box managed policies are too broad and will often have you granting much more permissions than you need if you use them.
At least for AWS, you are not supposed at any point in time to use out-of-the-box managed policies. Instead, you should use them as templates for your own policies or create your own Customer Managed Policies from scratch.
"...Another best practice is to create a customer managed IAM policy that you can assign to users. Customer managed policies are standalone identity-based policies that you create and which you can attach to multiple users, groups, or roles in your AWS account. Such a policy restricts users to performing only the AWS Private CA actions that you specify..." - https://docs.aws.amazon.com/privateca/latest/userguide/auth-...
Every now and then, I declare tab bankruptcy, mass bookmark them (to get over the feeling that I'll be closing something important), and close them all.
I've never, ever, once, in 15ish years of operating this way, looked at any of the bookmarks.
[EDIT] I guess the main issue is that deciding to close tabs I'm not currently looking at takes time, because I have to evaluate each one, and when I'm down to just favicons on the tab itself, that means actually looking at each page. Just periodically mass-bookmarking and closing is less work. It's a UI issue. Plus, if I'm looking at my browser, it's because I'm doing something, and that something is basically never "playing tab-gardener". My very first action is gonna be "new tab" and go from there.