Give the function a narrow role

You are a backend developer on the reports team, and a teammate is about to ship a Lambda function called report-generator. It reads one object from the reports bucket each morning and writes its own log lines, and it has no identity of its own yet. Almost nothing you build runs as you personally, so before that function can call AWS it needs an execution role.

With AmazonS3ReadOnlyAccess attached, if report-generator were compromised tomorrow, what is the most it could reach?