The customer was running important workloads in AWS and wanted to reduce the business risk that can come from excessive user access, delayed security response, or unnoticed configuration changes. From a business perspective, the concern was simple: the customer needed confidence that only the right people could access critical resources, that security issues would be noticed quickly, and that important changes would not remain unnoticed for long. 

This mattered because a security issue in the cloud can quickly become an operational or business issue. An inappropriate permission can expose information, a missed security finding can allow a threat to remain active, and an incorrect configuration can create compliance or service risk. The customer therefore needed a more consistent way to control access, identify problems early, and act on important findings without depending entirely on manual checks.