How should AWS IAM be designed for production in AWS?

Prefer roles and temporary credentials, use least-privilege policies, separate human and workload access, enable MFA, review access with IAM Access Analyzer, and apply permission boundaries or SCPs when appropriate.