Most high level AWS API clients don't provide an easy way to map their operations into well thought low level IAM permissions.
So you might need many iterations of trial and error possibly involving different teams (dev, sec, ops, etc...) just to figure out the minimum pivileges needed for something.
As a concrete example, check the docs for boto3's upload_file method: https://boto3.amazonaws.com/v1/documentation/api/latest/refe...
UploadFile is not a S3 API action, so there's no IAM policy for that. It's up to you to search in the docs and in the internet which S3 APIs upload_files uses under the hood and how to properly design a policy for those.
As a possible solution, here's how AWS CDK does things:
> a = SomeResource()
> b = OtherResource()
> a.grant_read(b)
Resources auto generate IAM policies from high level constructs, which leaves much less room for human error.
