Millions of records were exposed — not because AWS failed, but because no one checked if the setup matched the policy.

source