I've gotten a lot better at it by being boneheaded about not giving up. By bashing my head into IAM, I've gotten pretty good at figuring out the right set of permissions, roles, etc for cross account stuff to work. It's definitely still a mess a shitty, slow feedback loop, but it's better to have security by default.