Sure, we have ways to protect against threats inside the perimeter, but having this much employee data creates an absolutely untenable attack surface.

Now more than ever, policies and controls should be written with the assumption that there are confirmed insider threats within AWS.