Your AWS compliance infrastructure can become a self-sustaining backdoor. Here's how the mechanic works, why standard IR misses it, and how to detect it in your own account. The Pattern Everyone Trusts Mature AWS orgs run this: AWS Config rule detects non-compliant resource → SSM Automation fires → resource fixed. It's a Well-Architected recommendation. Security teams trust it. Almost nobody audits whether a given Config rule is enforcing the right thing. Inversion in 8 Lines A custom Config rule's evaluation logic is a Lambda function returning COMPLIANT or NON_COMPLIANT . Flip the polarity: def lambda_handler ( event , context ): invoking_event = json .…