I'm still not clear what I need to do to protect myself from a similar class of misconfiguration mistakes. "The first command, when executed, obtained securit

I'm still not clear what I need to do to protect myself from a similar class of misconfiguration mistakes. "The first command, when executed, obtained security credentials for a role known as *-WAF-Role" says the affadavit. Was some web app of CapOne coded so the JavaScript app fetched IAM credentials over HTTP so it could do its job by accessing some other S3 bucket?? And thats how Paige or someone she knew found the toehold in? That would be pretty brain dead. Or was it more subtle in terms of pure WAF misconfiguration?