Surprised about this one: > Start with users who have both passwords and access keys. If you recognize them, send an email asking them what the keys are being

Surprised about this one: > Start with users who have both passwords and access keys. If you recognize them, send an email asking them what the keys are being used for and whether they can be disabled. Chances are they left a script running somewhere. Are there really devs out there who use exclusively AWS console and not CLI tools? In my experience, AWS console is useful but inadequate for many day-to-day tasks. For example, S3 is way easier to use via some sort of FUSE filesystem. Cloudwatch logs viewer interface is atrocious, etc... And if you are a part of the team it is often much easier to check in “create_foo.sh” script with complex command line than write a wiki page with careful screenshots for each step of resource creation process.