“We were well aware of IAM’s provable security via automated reasoning, and the documentation is so comprehensive (and intimidating at times) that we were sure it had to be our fault”
Stedi reported in June 2023 that read-only roles were getting admin access through STS tag handling. AWS first called it customer misconfiguration, then found the same flaw reached boundary policies and SCPs. The fix for new roles landed in October and for affected customers in January. AWS sells IAM as provably secure, and its own policy simulator can’t even evaluate role trust policies.