cfn_nag has this as a default security rule. So there’s one place to lay blame.