The main problem with AWS IAM is you have to understand the service, how it works, and what the permissions do to restrict permissions correctly.

But that's true for anything with granular permissions.

Answering "what permissions are needed to perform X" is hard in any context. In AWS it can be overwhelming because AWS is big and interconnected.