AWS might be partly to blame, for not warning them, actively or passively, in my opinion. It might just be infrastructure as a service, but it seems that major cloud providers like AWS act as an IaaS provider when convenient, and a PaaS when convenient. They censor content all the time. I don't think it would be too much to ask to send an email when a big security change is made (the emails and audit log GitHub provides for its users are great). Plus their interfaces (UI and command line) are clunky. They should have a non-clunky dashboard of some sort where people can get a broad level overview of their security choices.

I'm not talking legal blame for the past mistake, just that at some point in the near future their IAM interface should be fixed. For one thing it should be easy to give permissions to view the permissions without giving keys to the kingdom. For another thing, there's a mental overhead to working with multiple AWS accounts [1]. I get the impression that Google Cloud Platform is ahead right now (while lots of other Google properties are not, heh).

Edit: the spyware company is absolutely to blame, but the complexity of AWS permissions including permission to view the permissions seems like a footgun to me. However, leaving open the admin site is something I wouldn't expect AWS to help with.

https://engineering.coinbase.com/you-need-more-than-one-aws-...