AWS Automatically Quarantines Exposed IAM Keys Within 10 Seconds of GitHub Leak
Brief
Amazon Web Services can move from detection to containment in seconds when an Identity and Access Management access key appears in a public GitHub repository.
In a controlled Unit 42 exposure test, AWS attached its AWSCompromisedKeyQuarantineV3 managed policy to the affected IAM user only 10 seconds after researchers published the credential, sharply reducing the window available for abuse.
Long-term IAM access keys remain attractive initial-access vectors because they can provide programmatic access without interactive authentication. Developers may accidentally commit them to source code, configuration files, or publicly accessible environment files.
GitHub secret scanning searches public repositories and other public surfaces for recognized credential patterns; through its partner integration, it reports detected AWS secrets directly to AWS so the provider can respond.