Make IAM part of the design of the application. If you need to use AWS API calls, then you need your app's design architecture docs (you have those right?) to list the IAM permissions needed to do each thing, and stuff that info into ADRs, and link to some IaC that you used to stand up your dev/test environment. All of this creates 1) formal IaC used to apply the permissions, 2) formal documentation of what functions need what permissions. As a final step during development, write tests that verify the IAM permissions are as expected.

You will of course need some way to scale this later, but as long as an artifact of your build pipeline is auto-generated IAM policy jsons, an org-wide security team can analyze them with automated tools and remediate as needed.