POWERUSERACCESS VS ADMINISTRATORACCESS FROM AN ATTACKER'S PERSPECTIVE

Summary from the TLDR InfoSec newsletter

PowerUserAccess is a broad managed permission for AWS that explicitly restricts a user's access to some actions related to IAM, Organizations, and Account. Attackers can often accomplish one-time goals such as crypto mining or ransomware with PowerUserAccess but would require AdministratorAccess to establish persistence. However, in practice, attackers can often find an overly permissive resource to exploit to escalate privileges due to PowerUserAccess violating the principle of least privilege.