IAM also offers some built-in help for the removal part, by listing which services were accessed recently: https://aws.amazon.com/blogs/security/remove-unnecessary-per...