Wait, so they managed to make AWS trigger a request on their own bucket using AWS internal credentials, and they extrapolate that this means they now have access to $everything ?
Not saying that it’s a certainty it’s not, but if you make such a claim, you should better have some evidence to back it up.