Spencer Gietzen

Scoping iam:AttachUserPolicy to the caller's own ARN hands out AdministratorAccess

A policy that lets users read and manage their own IAM profile usually carries iam:AttachUserPolicy scoped to ${aws:username}. That scope is enough to attach AdministratorAccess to yourself in a single call.