Oh, that breaks my trust model. I'd expect that if AWS adds something to an existing managed policy that it would be only for a newly launched service and that

Oh, that breaks my trust model. I'd expect that if AWS adds something to an existing managed policy that it would be only for a newly launched service and that it's consistent with prior permissions. Adding a permission to existing services is not OK. I'm curious why they felt the need to do that. Ideally this is a good place for versioning their managed policies. I should choose to update a managed policy only after I review it. This seems like it needs to be reverted.