Cloud IAM misconfigurations: public buckets, broad roles and Capital One

Most cloud breaches I’ve read about didn’t need a zero-day in the cloud provider. They needed a storage bucket that was readable by the world, or a role that could do far more than its job required, or both. The provider did exactly what it was told. The configuration told it the wrong thing. The…