This feels like may be he at some point discovered that his AWS access to Cisco account was intact and got curious about it and maybe even did some harmless thi

This feels like may be he at some point discovered that his AWS access to Cisco account was intact and got curious about it and maybe even did some harmless things. Then while playing around with GCP he managed to run something that deletes stuff (Terraform maybe) but the credentials used were that of Cisco AWS account which wasn't what he intended - clearly just deleting stuff is not the smart thing to do when it will be recorded against his AWS credentials. I think he is pleading guilty to unauthorized access which was intentional - but not to the deletion which was unintended.