Comment by vytvy

FYI, the policy to delete logs, just deletes them from your aws account, but they are still accessable/recoverable from aws side if needed. So this guy, that worked as cloud lead in ubiquiti was stupid enough to think it will hide his traces by deleting logs :DD it might have worked if he deleted them in bare metal server itself,but in aws it just deletes from account/s3, but can be recovered by AWS support. so this is how they got all the logs and found that it was him that logged in with his own aws user, and ip address from surfshark.