It doesn't matter how easy something is to set up and run from technology side if actually being able to set it up and run it takes half a year or more coordination calendar time, justification to several different departments, their review and approval. It's completely understandable, regulations and audit requirements are what they are: but then it is strange to read that modern developers somehow are paralyzed with terror. Well, the ones who were willing to try new things got shitcanned long time ago, this is the people who you have.

Isn't it anyway better for admin and security folks to have developers not get any ideas and stick to the bounds of the box?