Yes. AWS is getting really confusing, IAM is not simple, which is bad. But S3 is a bread-and-butter service, and the policy is such that anyone using it shoul

Yes. AWS is getting really confusing, IAM is not simple, which is bad. But S3 is a bread-and-butter service, and the policy is such that anyone using it should understand. I mean it says there in 'almost plain English' than 'anyone' can write content. This is a pretty major blunder, because it hints that maybe they don't have any security reviews at all. If I, a completely non security-knowledgable person were asked to do an audit of Twilio, I would find this issue. It's way on the lower treshold of 'obvious problem'. Twilio is not 'Medium Blog' - they provided IT plumbing and therefore it's doubly problematic.