If I don't secure any resources on AWS, even for a one off test dummy without any real data in it I receive a barrage of eMails from CIO. So does my technical s

If I don't secure any resources on AWS, even for a one off test dummy without any real data in it I receive a barrage of eMails from CIO. So does my technical studio lead. If we don't react within 24 hours the technical MD of our org will be on the receiving end of these emails as well. So within the org I am part of it is actually absolutely clear what the basic security configuration is. But it is also such a hassle, that I at least (being a data analyst sometimes in need of a short one off project for testing) just don't use it anymore for anything ephemeral (living few days at most) without containing any real world data. Securing the AWS instance would more often than not actually take nearly as much time as setting up a proof of concept project for a demo itself. More often than not that is only replicating an existing poc and changing a few images, fonts and a bit of text to make it look more like the client's pages/corporate identity. Then a short demo in a meeting and after that a tear down. Worst case these demos are live for 3 days. So security as well as compliance add 50 - 100% of effort in these cases. Making POCs on AWS just not worth the effort. As much as I understand that anything more than a poc needs to be secured I would wish for a way of communicating that some things are just so temporary as to not warrant this overkill. But as this could be abused, there just isn't. So tl;dr: Orga can ensure security and best practices in AWS if the invest to monitor and check automatically. But that does have other consequences as well. [Edit] : typos