[abhisek]

IAM is complex. More so with federation and cross account trust. Not sure every weakness can be considered as a vulnerability.

In this case, I was looking for a threat model within which this is a vulnerability but unable to find so.

[jonfw]

The security industry, unfortunately, is awash with best practice violations masquerading as vulnerabilities