Ensure IAM AWS-Managed policies that allow full "*:*" administrative privileges are not attached.