Overprivileged IAM Policy

Challenge Question

This is an exported snapshot of IAM users and the policies attached to them from a cloud account audit. On paper, none of these accounts look like they have full admin access. Trace what each one can actually do, including what they can grant themselves, and find the path from a low-privilege account to full control.