A team spun up a fleet to load test a release on a Thursday. The release went out. The fleet stayed. Nobody looked again until the following month, when finance asked why one cost centre had jumped by five figures.
It took Duke twenty minutes to find and kill. That is the part that still annoys us. Twenty minutes of work, four weeks late, because nothing in the account had an opinion about idle machines at 3 a.m.
The IAM half came from the same estate. Fixing it meant reading a policy so nested that three engineers disagreed about what it actually allowed. Not a hard question. Just written in a language humans do not read well.
So: park what nobody is using, and say plainly who can do what. That is the whole company. We are not adding a tenth module.