For a verified, minimal policy: deploy once an intentionally broad admin policy in a sandbox account, then run AWS IAM Access Analyzer's (https://aws.amazon.com/iam/access-analyzer/) "generate policy from CloudTrail activity" against that CloudTrail trail.