CloudFormation Least Privilege Can Fail Outside the Service You Think You Are Deploying

CloudFormation resource operations can depend on adjacent-service APIs, so least-privilege fixes should follow the exact denied action rather than the template's obvious service boundary.