My comment wasn't intended as an attack. I was just curious about their approach to sandboxing, as it's my area of expertise. Sometimes systems that are secure

My comment wasn't intended as an attack. I was just curious about their approach to sandboxing, as it's my area of expertise. Sometimes systems that are secure with two parties become horribly insecure when you add a third. I don't know a lot about IAM but generally I'd be very cautious about using standard access control mechanisms to implement sandboxing while running the code "in your account", as often you find resources are made available to "the whole account" with no further access control settings, because the system designers didn't imagine customers running true third-party code. That said Amazon has some pretty thorough access control features and I'm sure Twilio has looked into it and figured out something reasonable.