When a serverless function is granted a blanket AdministratorAccess policy, the blast radius of a compromised function is the entire account. In 2025, a handful of high‑profile breaches were traced back to overly permissive IAM roles attached to Lambda, Cloud Functions, or Azure Functions. The fix is simple: reduce the scope of the role to the minimum set of actions required by the function. Below is a practical walkthrough that blends AWS, Azure, and GCP examples, with a focus on Linux sysadmins who are comfortable with CLI, JSON, and policy evaluation.