Not the theoretical stuff from a security checklist.

I mean the kind of thing where you look at an AWS account and think:

I'm building an open-source AWS security scanner and I've started realizing that the interesting part isn't just how many checks a scanner has.

It's whether those checks actually catch the weird stuff people accidentally leave behind.

For example, one of the first real accounts someone tested my scanner against had a forgotten access key that nobody realized was still there.

That got me thinking:

What are the security mistakes that AWS developers actually make repeatedly, but security tools don't make obvious enough?

Could be:

• forgotten IAM users/keys
• overly permissive security groups
• weird cross-account trust policies
• unused privileges
• public resources
• logging gaps
• something completely different

I'm collecting real examples because I want to turn them into better test cases for Plexavo.

What's the most ridiculous AWS security/configuration mistake you've personally encountered?

Bonus points if it's something a scanner would normally miss.