Removed: nothing. The role was still holding broad permissions over S3 buckets of customer data when the credentials were taken, and no boundary limited what they could reach.
Outcome: the theft of records covering 106 million people, from credentials that should have been able to do very little.
The 2019 Capital One breach occurred because a firewall misconfiguration allowed SSRF, which was exploited to access AWS metadata service and retrieve IAM credentials. Those credentials had overly broad permissions allowing access to S3 buckets containing customer data.
If least privilege had been applied, the stolen credentials would have had minimal impact.
What the role could reach was worse than one database. The haul included data from backups spanning multiple years — copies that served no business purpose and had never been deleted. Retention turned a credential problem into a hundred million records.
Sources: