intrusion occurred through a misconfigured web application firewall
The affidavit states “exfiltrating and stealing information, including credit card applications and other documents”.
She used a particular role to exfill from an S3 bucket. Not sure how she got the creds for the role she used to execute List Buckets, etc...
Affidavit shows the accused was an employee at the unnamed cloud vendor (clearly AWS at this point) from 2015 - 2016.