It's explicitly mentioned in the article:
A step by step breakdown of the attack Step 1. Gaining Access to Resolv’s AWS KMS Environment
The link was changed, the old one did not mention it (apparently): https://news.ycombinator.com/item?id=47498220
The link was changed, the old one did not mention it (apparently): https://news.ycombinator.com/item?id=47498220