Okay, so I've been trying to get my head around AWS IAM policies for a new project. I'm not an infrastructure expert, I mostly do the Shopify side and front-end stuff, but I need to set up some permissions for a Lambda function.
Every single AI assistant I've tried—Claude, ChatGPT, even the coding-specific ones—gives me something that *looks* right but then either fails in the console with a vague error or is wildly over-permissive. It's like they're all trained on the same flawed examples.
Just yesterday, I asked for a policy to let a Lambda read from a specific DynamoDB table and write to a specific S3 bucket prefix. The output was a jumble of `"Resource": "*"` and weird `"Action": "s3:*"` combos that made my security lead raise an eyebrow. When I pointed out it was too broad, the assistant just tacked on a condition block that didn't even match the resource ARN structure.
My question is: is this a known thing? Like, a failure mode that's just hard for them? I'm starting to think I need to go back to the AWS docs and forget asking for help, which is a bummer because I learn better by seeing examples and tweaking them.
What's the actual correct process? Manually writing the ARNs for every single action? Using the policy generator and then trimming? I feel like I'm missing a basic step everyone else knows.