I am a junior developer struggling to understand how to properly set up AWS IAM roles and policies without accidentally giving full admin access to my team.