IAM privilege escalation

Leaked CI credentials can quietly escalate to full admin. Discover the path, prove it by capturing a flag, then close the hole.