I agree that this is what everyone should strive to do but this quickly hits a limit.

For example, IAM/S3/SQS policy evaluations can have profound impact on an application running but an abstraction wouldn’t help much here (assuming the developer is putting any thought into securing things). There just isn’t an alternative to these. If you’re rolling out an application using AWS-proprietary services, you have to get into vendor-specific functionality.

My point is you should not build on top of their native services if it incurs this problem.