Ensure that IAM role policies are scoped properly as to not provide access to unused AWS services.
IAM role policies should only contain actions for resource types which are being used in your account i.e. dynamodb:ListTables permission should only be given when there are DynamoDB tables to adhere to security best practices and to follow principal of least-privilege.
Ensure that all IAM roles are scoped to specific services and resource types.