A DuckDB report job queried Parquet files on S3 fine on a laptop and failed with HTTP 403 in its ECS task. Locally DuckDB used a persistent secret from personal credentials; in the container nothing told it to use the task role. How DuckDB secrets and the credential chain work, plus the KMS detail.
Terraform created our new EKS cluster cleanly, then nobody could use it: kubectl said we must be logged in, and the Helm step in CI failed the same way. The cluster had API-only authentication, no creator admin, and access entries for the wrong role ARNs.
A developer role was meant to allow everything except IAM changes. Its policy used Allow with NotAction, yet a review found it could create access keys for other users and assume an admin role. How we found it with the policy simulator and Access Analyzer, and rewrote it safely.
A developer committed a .env file with a live AWS access key, then deleted it in the next commit. The key stayed in history. We revoked it within 40 minutes, checked CloudTrail, rewrote history with git filter-repo and added scanning so it cannot happen again.