There are many stories of AWS users setting their access rules improperly because they weren't given sufficient time or resources to understand how to use them, in some cases leaving S3 containers for example wide open. It isn't just the technology, it's the incentives, people and processes as well.