Exposed identity token doesn’t always mean we can exploit, create a user and check which all resources can you access in AWS