as another anecdote, Q advised me to update a security group with a rule to allow ingress traffic on specific ports from a Lambda function execution role. It's jumbling up documentation from two completely different security tools; it's only a matter of time before Q causes a prod incident somewhere.