It really depends on the way you set it up and use it. Raw EC2 instances are obviously the most dangerous items.

RDS databases, DynamoDB, and S3? Much less so.

> you set it up and use it

That's my point: I'm not the one setting it up and using it, it's the devs using it

And I'm not expecting them to know how to navigate a cloud provider securely.

So it's either setting the dev account with all the required guardrails in place, or using "local cloud" on their computer