AWS SECURES AWS. EVERYTHING ELSE IS YOUR ATTACK SURFACE.

Summary from the TLDR InfoSec newsletter

AWS-native tools protect what's inside AWS. But modern attacks move across identity, SaaS, on-prem, and other clouds, before and after they ever touch AWS.