AWS Automatically Quarantines Exposed IAM Keys Within 10 Seconds of GitHub Leak
AWS quarantined a leaked IAM key 10 seconds after Unit 42 published it to public GitHub.
Palo Alto Networks Unit 42 published a controlled test showing AWS attached the AWSCompromisedKeyQuarantineV3 policy 10 seconds after an IAM access key was pushed to a public GitHub repository on December 19, 2025. GitHub secret scanning reported the secret, and CloudTrail recorded AttachUserPolicy at 18:50:15 UTC, though the event attributed the action to the affected user. The managed deny policy, evolved from a 2020 original through V2 and V3, blocks selected high-risk actions across services including IAM, S3, Lambda, Bedrock, and SageMaker without revoking the key. AWS still expects administrators to rotate or deactivate exposed keys and hunt surrounding CloudTrail activity.
- Unit 42 saw AWSCompromisedKeyQuarantineV3 attached 10 seconds after a public GitHub push.
- CloudTrail named the IAM user as the actor, not AWS automation.
- Quarantine denies selected high-risk actions but does not disable the key.
- Alert on AttachUserPolicy events for AWSCompromisedKeyQuarantine, V2, or V3.
- Organizations
- Unit 42
From the original article
3 min read at cybersecuritynews.com
Amazon Web Services can move from detection to containment in seconds when an Identity and Access Management access key appears in a public GitHub repository. In a controlled Unit 42 exposure test, AWS attached its AWSCompromisedKeyQuarantineV3 managed policy to the affected IAM user only 10 seconds after researchers published the credential, sharply reducing the window […]
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.