tbf IAM is the bastard child of many cloud providers.

It exists to provide CISOs and BROs a level of security that no one person has access to their infrastructure. So if a company decides that system A should no longer have access to system B, they can do that quickly.

IAM is so complex now that it’s a field all in itself.