My personal experience with IAM is that it makes AWS awful to work with. I honestly wish it was replaced with an service far simpler in design. CloudWatch is similarly obtuse.
I think you have a point with Lambda though I don't use serverless much. How does Knative compare?