It must be a fun job to spend the day poking software looking for holes.
Wish I could do this all day long...
Aside, the fact that it took almost 4 months to remediate all accounts is crazy. AWS and cloud in general was supposed to make it dumb easy to upgrade, patch and maintain infra software in production.