your S3 bucket permissions are clearly worthy of periodic review. better tooling makes this easier to do. And you should have this done by somebody who knows

your S3 bucket permissions are clearly worthy of periodic review. better tooling makes this easier to do. And you should have this done by somebody who knows it well, or who learns it well in the process. No one knows S3 better than the AWS S3 team. It took us half a day to get the bucket locked down to where only the root AWS IAM user—secured by physical 2fac—was permitted to change the SDK Or a small feature team could spend a month or two improving the user experience so that literally every S3 customer doesn't have to have the technical acumen, knowledge of risks, and time to get this right. 0.5 days * a million users (to be conservative) is 500,000 days.