You're spot on about simplicity, and it's the reason AWS may not remain the top cloud provider for much longer. There is no effort to implement any sort of consistency across their famed two-pizza teams -- that wouldn't be "Day one". So each service has its own IAM quirks, making basic security at scale a nightmare, and in some cases impossible.

Azure policies are comparatively a breeze, making it the smart and increasingly obvious choice for any regulated (read: large) corporation.