I spent three days last quarter unfucking a multi-tenant agency infrastructure where a single compromised staging site wiped the entire shared object storage bucket. 1.2 terabytes of client media. Poof. Gone in four seconds because someone passed s3:* on resource:...
I once audited a multi-tenant WordPress platform hosting 450 client sites on a single high-density cluster. Every single tenant shared a single set of AWS IAM access keys with wildcard privileges on a global bucket. One compromised plugin on a...