Applying Least Privilege to EC2 Roles and S3 Policies with IAM Access Analyzer

In the context of securing AWS resources with least privilege, what specific steps should I take to configure IAM roles for EC2 instances and bucket policies for S3 so that permissions are tightly scoped, how can I leverage IAM Access Analyzer to generate and validate these policies based on actual access activity, and what verification and rollback procedures should I follow to ensure that tightening permissions does not break existing workloads?