Some AWS resources currently have broader permissions than necessary for their intended function.
For instance, all Lambda functions (both coordinator and perspective functions) are currently attached to the AWSLambdaRole managed policy (https://docs.aws.amazon.com/aws-managed-policy/latest/reference/AWSLambdaRole.html), which grants permission to invoke any Lambda function within the account.
A full permissions review should be conducted to ensure that all resources adhere strictly to the principle of least privilege.