IAM Policy to deny API actions that could potentially allow privilege escalation.

iam_priviledge_escallation_deny_poilcy.json

{
	"Version": "2012-10-17",
	"Statement": [{
		"Sid": "DenyPriviledgeEscallationActions",
		"Effect": "Deny",
		"Action": [
			"cloudformation:CreateStack",
			"codestar:AssociateTeamMember",
			"codestar:CreateProject",
			"codestar:CreateProjectFromTemplate",
			"datapipeline:CreatePipeline",
			"datapipeline:PutPipelineDefinition",
			"dynamodb:CreateTable",
			"dynamodb:PutItem",
			"ec2:RunInstances",
			"glue:CreateDevEndpoint",
			"glue:UpdateDevEndpoint",
			"iam:AddUserToGroup",
			"iam:AttachGroupPolicy",
			"iam:AttachRolePolicy",
			"iam:AttachUserPolicy",
			"iam:CreateAccessKey",
			"iam:CreateLoginProfile",
			"iam:CreatePolicyVersion",
			"iam:PassRole",
			"iam:PutGroupPolicy",
			"iam:PutRolePolicy",
			"iam:PutUserPolicy",
			"iam:SetDefaultPolicyVersion",
			"iam:UpdateAssumeRolePolicy",
			"iam:UpdateLoginProfile",
			"lambda:AddPermission",
			"lambda:CreateEventSourceMapping",
			"lambda:CreateFunction",
			"lambda:InvokeFunction",
			"lambda:UpdateFunctionCode",
			"lambda:UpdateFunctionConfiguration",
			"sagemaker:CreateNotebookInstance",
			"sagemaker:CreatePresignedNotebookInstanceUrl",
			"sts:AssumeRole"
		],
		"Resource": "*"
	}]
}

Source: https://raw.githubusercontent.com/RhinoSecurityLabs/AWS-IAM-Privilege-Escalation/master/README.md