Fixing IAM policies is hard, and what have we done to solve it
segment.com