For example, if you want your CI/CD to deploy to CloudFormation and allow it to generate IAM resources, then it's essentially root-level access. Because you can simply create an IAM role that gives admin permissions to you.

Or even without that, there are plenty of footguns. AWS has a good blog post: https://aws.amazon.com/blogs/security/protect-sensitive-data...