is that actually their approach? amazon already had a technique for limiting access to prod, by denying access without one of your team members agreeing that th

is that actually their approach? amazon already had a technique for limiting access to prod, by denying access without one of your team members agreeing that that needs to be done. maybe they skipped it to get access to prod in some way, such that the cloudformation could be deployed from a developer desktop? or the thing they got permissions to has too broad of permissions. a choice of "a person needs to read this" vs "a machine needs to push back on this" has amazon as far as ive seen push to the latter