I imagine it was bad communication between the guys handling AWS credentials and IT.

At most companies IT handles logins and credentials for all internal systems. Things like email, vpn, internal sites, and chat. Usually this is all centralized, and when someone leaves IT revokes that user's access to everything.

I'm guessing what happened here was that the engineer got access to AWS manually. Maybe IT wasn't responsible for handling AWS credentials and it was expected that the person who gave him access would revoke it too. Alternatively, the person who gave him might not have gone through the company's regular policies.

Either way, the process in place for handling credentials here clearly didn't work and they got burned in it. Would love to see the internal postmortem here.