> You simply can't count on the baseline configuration of your account and instances provided by AMS, you need advanced knowledge on how to secure your resources beyond basic stuff like MFA and monitoring.

When could you? when AWS was security by obscurity a decade ago.

When you create an account, one of the first things AWS has you acknowledge is the Shared Responsibility Model.

AWS has always given you the rope to hang yourself.