Attack path detected (confidence 94%):
**dev-bot** has sts:AssumeRole on **ci-deploy**, which has AttachRolePolicy on * without an MFA condition. This allows attachment of AdministratorAccess to itself, granting unrestricted account access.
From ci-deploy, the actor launched EC2 instance **i-0a4b7c8d9e**, which has s3:GetObject on the **audit-logs-prod** bucket. That bucket has a public ACL, directly exposing all objects to **198.51.100.7** (ASN: Hetzner, threat score: 94).
**Immediate actions:**
1. Revoke ci-deploy's AttachRolePolicy permission
2. Apply s3:GetObject deny for external principals on audit-logs-prod
3. Remove public ACL from audit-logs-prod
4. Rotate access keys for dev-bot and ci-deploy