Amazon's IAM permissions are very strange. I like the amount of granularity - but things like "You can't delete a key if you can't list all keys, even if you specified the key ID in the delete action" is really frustrating and makes the granularity not work.