A deploy role that can become admin
The CI role looks scoped to deploys, but one statement lets it hand any role to a new EC2 instance. Read the policy versions with the AWS CLI and find the escalation path.
Briefing
An access review flagged the ci-deploy role as "possibly over-privileged". You have read-only IAM access.
iam:PassRole lets a principal attach a role to a service, such as an EC2 instance profile. Combined with ec2:RunInstances on any resource, a CI job could start an instance with the admin role and use its credentials.
cloud-shell · Cloud CLI review
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.