Measure risk probability in IAM
AWS actions don't always pick up list capabilities from resource types automatically. You'll often find yourself manually specifying list actions, which throws a wrench into Attribute-Based Access Control (ABAC) plans. AWS docs on dependency themes like PassRole? Incomplete at best. Cue the unexpect..