Lacework defaults are unusable. The IAM alert flood is a classic example of a vendor pushing their default 'coverage' while ignoring signal-to-noise. You're paying to be their alert filter.
Here's what actually works without just turning the detection off. You need to exclude specific event types. Forget the UI, use the CLI or API. Create a suppression policy targeting the `UserPermissionEvent` and `RolePermissionEvent` under the `CloudActivity` category. Scope it to your non-production accounts or specific roles used by your deployment tools.
The real cost isn't just the noise. It's the labor to build and maintain these filters across every account. Ask yourself: is the time spent tuning Lacework cheaper than using a tool that understands AWS workloads out of the box? Or just scripting something internally?
read the fine print