Shadow Permission Analyzer

An intern can reach production in four hops.

No single IAM policy in this account looks wrong. The danger is in the composition — each role can assume the next, and four assumptions later a temporary intern account is sitting on the production database. Pick a user below and watch breadth-first search find it.