Enumerate what a stolen AWS key can actually do

Start with identity and cheap read calls, then brute permissions safely rather than firing destructive actions blindly.

aws sts get-caller-identity
aws iam get-account-authorization-details 2>/dev/null | head   # if allowed

When IAM read is denied, enumerate by probing.

enumerate-iam --access-key AKIA... --secret-key ...   # brute allowed actions read-only

Pro note: prefer read and list probes; a wall of AccessDenied on write actions is noisy in GuardDuty and CloudTrail. Once you know the allowed actions, map escalation edges (PassRole, AttachUserPolicy, CreatePolicyVersion, UpdateFunctionCode) with pmapper before acting.