Security ignored when using Service Connection for Classic Release AWS tasks

**Describe the bug**

We’ve set security for Azure DevOps organization AWS Service Connection to our production account so *only* a project Release Administrators group has ability to make use of it. Set for both Project and Organization security of the Service Connection.

However, our engineers do have rights create and edit Classic Release pipeline definitions, including adding stages for our production stacks (which make use of Variable Group variable to set which AWS Service Connection to use).

When an engineer creates Release pipeline from definition, they are still able to deploy to AWS production even though lack rights to be using the Service Connection. Realize that we could be making use of a pre-deployment approver gate, however because the engineers are able to create/edit release pipelines that doesn’t really provide security (i.e. they would be able to edit who the approvers are of the production stages).

REQUIREMENT:
We require separation of duties as part of deployments into production.

QUESTION:
How can we have an end-to-end (dev to qa to preview to production) release pipeline which can be edited by development team but which has security in place to only allow project Release Administrators group rights to complete production deployments which use the AWS Service Connection?

**Expected behavior**

Expectation would be that if person who created the Release pipeline or clicked the Deploy button for production stage does not have rights to use Service Connection, then an “access denied” would occur when attempt is made to use the service connection.

Instead, they are able to complete the deployment (even though do not have rights to use the production AWS Service Connection).
**WORK AROUND** Our work around is to disable the access key within AWS production account until needed for deployment, but that introduces toil into the CI/CD workflow (and potential security risk if failing to inactivate the access key again afterwards).

**Your Environment**

- On-prem or cloud based?: Cloud
- Azure DevOps version: latest
- AWS Toolkit for Azure DevOps version: 1.12.0

Start by reproducing the reported Classic Release deployment with the AWS Service Connection and the permissions described for version 1.12.0. Trace how Service Connection authorization is applied when a release is created or deployed; done means unauthorized engineers can still edit development stages but receive access denied for production deployments.

Written by the indexing model from the issue text.