PALO Alto Networks’ Unit 42 has detailed how AWS responds when long-term IAM access keys and secrets are exposed, particularly through public GitHub repositories. AWS can automatically attach its AWSCompromisedKeyQuarantine managed policy to the affected IAM user. The policy uses explicit Deny rules to block selected high-risk actions while leaving other permissions and existing resources operational, meaning it limits likely abuse rather than disabling the identity completely.
AWS created the policy on 11 August 2020, released V2 on 21 April 2021 and V3 on 21 August 2024. Its rules have expanded to cover activity involving services including S3, EC2, Lambda, ECS, Bedrock, SageMaker and others.
In a Unit 42 exposure test on 19 December 2025, an access key and secret pushed to a public GitHub repository led to AWS attaching AWSCompromisedKeyQuarantineV3 within 10 seconds. GitHub sent an alert, while AWS generated a Health notification, email and Support case containing details of the exposed key and IAM user. The researchers noted that the automated policy attachment appeared in CloudTrail as an AttachUserPolicy event, although the userIdentity field misleadingly named the affected IAM user as the actor. GitHub’s validity checks also performed an STS GetCallerIdentity request, which appeared in CloudTrail.
The researchers recommend monitoring CloudTrail for AttachUserPolicy events referencing the quarantine policy, and for GetCallerIdentity requests from GitHub-associated IP addresses using GitHub’s AWS validation user-agent strings. They caution that GitHub push protection may miss secrets in very large pushes or report only five secrets in a single push, creating possible detection gaps. AWS notifications and Support cases should be reviewed promptly, and the exposed credentials investigated and replaced.