Enumerate what a stolen AWS key can actually do
Before escalating, map the identity's real permissions with low-noise calls to avoid dead ends and access-denied storms.
Tag: enumeration
Map ACL attack paths with BloodHound before touching anything
Collect once, then let the graph show the shortest ACL path from your foothold to Domain Admin.