AWS access logs showed an account that shouldn’t exist. IAM policies, thought to be locked down, had drifted over months of rushed deployments. The engineers pulled up CloudTrail, traced the permissions, and found a chain of over-permissive roles linked to an old test environment—unmonitored, unused, and invisible until