FYI, the policy to delete logs, just deletes them from your aws account, but they are still accessable/recoverable from aws side if needed. So this guy, that worked as cloud lead in ubiquiti was stupid enough to think it will hide his traces by deleting logs :DD it might have worked if he deleted them in bare metal server itself,but in aws it just deletes from account/s3, but can be recovered by AWS support. so this is how they got all the logs and found that it was him that logged in with his own aws user, and ip address from surfshark.

Presumably with an IP log by a router/IDS/ENS at the corporate or ISP level.

Which discount code did he use?

Use CYBERWEEK19 for 85% your first years subscription.