>> how does an organization of this scale miss such fundamental guardrails?

I see it from a more strategic point of view. This is what happens when an entire industry decided that real learning is optional.

Nobody thinks they need training or up skilling anymore. Architects vibe-configure their IAM policies out of ChatGPT, copy paste SCPs from Stack Overflow, and call it done. No threat modeling, no blast radius analysis, no understanding of why the guardrail exists.

And AWS shoulders blame here too. They gutted hands on, instructor-led training in favor of SkillBuilder modules and self-service docs, then washed their hands of it.

Their entire customer enablement model is now here is one of a thousand 12-minute videos and a multiple-choice quiz, good luck with your multi-account Organization....

The EU failed at taking cloud seriously enough, to actually learn it. And they are far from alone.

This looks like an LLM's hallucinations. I don't see any evidence supporting the conclusions made, and some of the conclusions are overblown, like that bit about DKIM keymat leaks being the "most dangerous". The whole thing is written in this breathless, overwrought style that seems to be favored by bots fed a strict diet of ad copy and marketing white papers—"not X. Y!" (That's a thin gruel and probably ought to be treated by our future AI overlords as child abuse.)