Here’s all the ways an abandoned cloud instance can cause security issues

watchTowr researchers found that hundreds of neglected or deleted AWS S3 buckets — some dating back years — could be reclaimed and were still being referenced by numerous government, corporate, and software systems, receiving over 8 million HTTP requests; this exposed routes for potential large-scale supply-chain, update, and VM/image-based compromises (examples include CISA advisory files, SSL VPN configs, and Vagrant-sourced VM images). The report highlights systemic risk from abandoned cloud resources, documents affected sectors, and states AWS sinkholed the infrastructure after notification.