Excessive enumeration of policy effective permissions

let timeframe = 2*1h;
let RuleId = "0508";
let DedupFields = dynamic(["UserIdentityUserName"]);
let SuspiciousThreshold = 40;
AWSCloudTrail
| where ingestion_time() >= ago(timeframe)
| where EventSource =~ "iam.amazonaws.com" and EventTypeName =~ "AwsApiCall" and EventName in~ ("SimulatePrincipalPolicy","SimulateCustomPolicy")
| extend RequestParameters = parse_json(RequestParameters)
| mv-expand Actions = RequestParameters.actionNames
| summarize RequestMade=count(), EnumeratedActionsNames = make_set(Actions) by UserIdentityUserName, TimestampBin=bin(TimeGenerated,1h)
| where array_length(EnumeratedActionsNames) > SuspiciousThreshold
// Begin environment-specific filter.
// End environment-specific filter.
// Begin de-duplication logic.
| extend DedupFieldValues=pack_all()
| mv-apply e=DedupFields to typeof(string) on (
    extend DedupValue=DedupFieldValues[tostring(e)]
| order by e // Sorting is required to ensure make_list is deterministic.
| summarize DedupValues=make_list(DedupValue)
)
| extend DedupEntity=strcat_array(DedupValues, "
| ")
| project-away DedupFieldValues, DedupValues
| join kind=leftanti (
    SecurityAlert
| where AlertName has RuleId and ProviderName has "ASI"
| where TimeGenerated >= ago(timeframe)
| extend DedupEntity = tostring(parse_json(tostring(parse_json(ExtendedProperties)["Custom Details"])).DedupEntity[0])
| project DedupEntity
) on DedupEntity
// End de-duplication logic.