Yes that’s the specific issue. We didn’t fear specifically they could read our data; the key management systems available appeared sufficient at some level (although the gcp audit system had some issues, particularly access audit is available as a IAM decision log rather than point of use, so any access bypassing IAM or that failed in the service but succeeded in an IAM call would appear a positive access, etc - aws does the right thing here). More of concern is they appeared more than happy to harvest utilization information for the profit of others, and in our business that was a potentially serious side channel.