AWS Security

Scoped identity with iam:PassRole could potentially run as prod-admin via a Lambda function it creates, if unblocked by policy controls

Permission-by-permission review scores iam:PassRole, lambda:CreateFunction and lambda:InvokeFunction as controlled access, while path analysis sees one route to whatever the passed role holds. Three policy layers decide whether that route is live.