The scenario walks every user in AWS IAM and sets them to your chosen default roles, skipping anyone on your exception list.