It's possible an STS token was obtained using the role. If you're not monitoring where those tokens are issued to and used from, you're gonna have a bad time.

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credenti...