IAM & RBAC policy generator

Method & limitations

Creates policy starters only; review and test before applying. S3 access is prefix-scoped, Kubernetes access is a namespaced Role without a binding, and GCP output is a binding fragment for a bucket policy. CloudWatch output permits writing streams in one existing log group. Existing grants, KMS keys, boundaries and resource policies can affect actual access. References: https://docs.aws.amazon.com/AmazonS3/latest/userguide/example-policies-s3.html and https://kubernetes.io/docs/reference/access-authn-authz/rbac/