[abrookewood]

It's explicitly mentioned in the article:

A step by step breakdown of the attack Step 1. Gaining Access to Resolv’s AWS KMS Environment

[leonidasv]

The link was changed, the old one did not mention it (apparently): https://news.ycombinator.com/item?id=47498220

[rithdmc]

Thank you! I was scratching my head at this, having seen 'Step 1'