By all means, check everything I boot up in AWS, but don’t prevent me from doing so in the first place.

My current company does this and it’s great. If I do something bad it gets destroyed in 30 minutes unless I fix it (we get notifications).