It's explicitly mentioned in the article:

A step by step breakdown of the attack Step 1. Gaining Access to Resolv’s AWS KMS Environment

The link was changed, the old one did not mention it (apparently): https://news.ycombinator.com/item?id=47498220