BTW I think IAM Roles would be a great place for awsx to improve. It's always so painful figuring out the right combination of things to create an AWS Role.

Totally agree! It’s at the top of the list: https://github.com/pulumi/pulumi-awsx/issues/167

Awesome! Will follow that issue.