[AshwinDurairaj]

Basically, I gathered from the indictment that they had a 'WAF misconfiguration', which I take to be SSRF allowing her to obtain temporary AWS credentials from the metadata endpoint, which have the WAF role they talked about, which has sufficient permissions to list buckets and download files etc.

[jcims]

This is precisely my read as well. Could be cred disclosure through a stackdump or the like as well but most likely SSRF.