IAM is where most AWS incidents begin. Replacing wildcards with scoped actions, ARNs, and conditions is the highest-impact control you have.