/
← Voltar ao feed
medium

AWS AWSCompromisedKeyQuarantine policy auto-quarantines IAM keys exposed on GitHub; Unit 42 tests and detection guidance

1 fonte(s) · 1 atualização(ões) · publicado 21/09/2026 07:00 · coletado há 1 dia

Unit 42 analyzed how AWS neutralizes publicly exposed IAM access keys by automatically attaching the AWSCompromisedKeyQuarantine managed policy, and how that policy has changed since its release on Aug. 11, 2020. The mechanism relies on the GitHub secret scanning partner program, which alerts AWS when long-term keys appear in public repositories. In a controlled test on Dec. 19, 2025, AWS attached AWSCompromisedKeyQuarantineV3 to the test IAM user 10 seconds after the key was pushed to a public repository. The research ties policy updates to real attack patterns, such as cryptomining via Lambda and IAM roles, S3 data deletion for extortion, and abuse of Amazon Bedrock. It also warns that the policy only denies selected actions, so advanced actors can still use an exposed key for any action not explicitly denied.

Technical Details

  • The policy uses explicit Deny statements, which override any Allow on the IAM user. This limits abuse without breaking normal business use, unlike AWSDenyAll.
  • Versions: V1 (Aug. 11, 2020) denied 28 actions across five services. V2 (Apr. 21, 2021) added S3 (11 permissions) and 16 more permissions. Across its five versions V2 grew to 61 denied permissions across 17 services. V3 (Aug. 21, 2024) replicated the V2 v4 and v5 additions.
  • Example mappings: iam:CreateRole and lambda:CreateFunction in V1 (cryptomining campaign), s3:DeleteObject in V2 (post-exfiltration deletion for extortion), and five Bedrock permissions in V2 v5 (Permiso research on InvokeModel abuse).
  • Test timeline (UTC): GitHub push protection warned at 18:46:57, the key was pushed at 18:50:05, AttachUserPolicy appeared in CloudTrail at 18:50:15, the GitHub email arrived at 18:50:16, the AWS Health alert at 18:50:17, and the AWS email and Support case at 18:50:26 and 18:50:59.
  • In CloudTrail, the attachment event's userIdentity lists the IAM user itself, not an AWS automated actor. The Health alert and Support case generate no CloudTrail events.
  • GitHub validity checks call STS GetCallerIdentity from GitHub ASN IPs with a GHAS-AWS_KEYID-validation user agent. GitHub changed the user agent text in early October 2025.
  • Push protection gaps: very large pushes (thousands of files or a repository over 50 MB) are not scanned, and when a single push contains more than five secrets, only five generate alerts.

Remediation

  • Alert on CloudTrail AttachUserPolicy events (event source IAM) where requestParameters.PolicyArn references any AWSCompromisedKeyQuarantine version.
  • Alert on GetCallerIdentity calls from GitHub ASN IPs carrying the GitHub validity-check user agent.
  • Aggregate AWS Support cases, for example with AWS Systems Manager Explorer, so the security team sees notifications that otherwise reach only cloud engineering.
  • Do not remove the quarantine policy. Follow the instructions in the AWS Support case, and investigate and rotate the exposed key.
  • Prefer least-privilege IAM permissions and avoid long-term access keys. Add extra scanning for large pushes and pushes with many secrets.

Linha do tempo

  1. unit42.paloaltonetworks.com ↗ · pub. 21/09/2026 07:00 · coletado 19/10 17:56 primeiro registro

    AWS AWSCompromisedKeyQuarantine policy auto-quarantines IAM keys exposed on GitHub; Unit 42 tests and detection guidance

    ler a análise desta fonte

    Unit 42 analyzed how AWS neutralizes publicly exposed IAM access keys by automatically attaching the AWSCompromisedKeyQuarantine managed policy, and how that policy has changed since its release on Aug. 11, 2020. The mechanism relies on the GitHub secret scanning partner program, which alerts AWS when long-term keys appear in public repositories. In a controlled test on Dec. 19, 2025, AWS attached AWSCompromisedKeyQuarantineV3 to the test IAM user 10 seconds after the key was pushed to a public repository. The research ties policy updates to real attack patterns, such as cryptomining via Lambda and IAM roles, S3 data deletion for extortion, and abuse of Amazon Bedrock. It also warns that the policy only denies selected actions, so advanced actors can still use an exposed key for any action not explicitly denied.

    Technical Details

    • The policy uses explicit Deny statements, which override any Allow on the IAM user. This limits abuse without breaking normal business use, unlike AWSDenyAll.
    • Versions: V1 (Aug. 11, 2020) denied 28 actions across five services. V2 (Apr. 21, 2021) added S3 (11 permissions) and 16 more permissions. Across its five versions V2 grew to 61 denied permissions across 17 services. V3 (Aug. 21, 2024) replicated the V2 v4 and v5 additions.
    • Example mappings: iam:CreateRole and lambda:CreateFunction in V1 (cryptomining campaign), s3:DeleteObject in V2 (post-exfiltration deletion for extortion), and five Bedrock permissions in V2 v5 (Permiso research on InvokeModel abuse).
    • Test timeline (UTC): GitHub push protection warned at 18:46:57, the key was pushed at 18:50:05, AttachUserPolicy appeared in CloudTrail at 18:50:15, the GitHub email arrived at 18:50:16, the AWS Health alert at 18:50:17, and the AWS email and Support case at 18:50:26 and 18:50:59.
    • In CloudTrail, the attachment event's userIdentity lists the IAM user itself, not an AWS automated actor. The Health alert and Support case generate no CloudTrail events.
    • GitHub validity checks call STS GetCallerIdentity from GitHub ASN IPs with a GHAS-AWS_KEYID-validation user agent. GitHub changed the user agent text in early October 2025.
    • Push protection gaps: very large pushes (thousands of files or a repository over 50 MB) are not scanned, and when a single push contains more than five secrets, only five generate alerts.

    Remediation

    • Alert on CloudTrail AttachUserPolicy events (event source IAM) where requestParameters.PolicyArn references any AWSCompromisedKeyQuarantine version.
    • Alert on GetCallerIdentity calls from GitHub ASN IPs carrying the GitHub validity-check user agent.
    • Aggregate AWS Support cases, for example with AWS Systems Manager Explorer, so the security team sees notifications that otherwise reach only cloud engineering.
    • Do not remove the quarantine policy. Follow the instructions in the AWS Support case, and investigate and rotate the exposed key.
    • Prefer least-privilege IAM permissions and avoid long-term access keys. Add extra scanning for large pushes and pushes with many secrets.