It sounds to me like she got access to an instance running on AWS and used its role to access S3. How she got access to that instance hasn't been revealed but l

It sounds to me like she got access to an instance running on AWS and used its role to access S3. How she got access to that instance hasn't been revealed but likely to be vulnerable software running on it that would have been protected by the WAF. All assumptions but my guess is that the particular vulnerability exploited is probably not that relevant to people in general.