other

AWSCompromisedKeyQuarantine

An AWS-managed IAM policy that denies a set of actions to a user whose credentials AWS believes are publicly exposed, while leaving the account's existing resources in place.

Known aliases

AWSCompromisedKeyQuarantine policy

Relationships

No evidence-backed relationships are recorded.

Current clusters

security1 publisher

AWS automatically quarantines leaked IAM keys and opens a support case for the affected user

Unit 42 traced AWSCompromisedKeyQuarantine through three versions since August 2020 and documented the GitHub secret scanning integration that lets AWS attach the policy to an exposed IAM user automatically, with the owner notified afterwards.

Publishers:unit42.paloaltonetworks.com

Reality

Evidence62
Adoption58
Hype gap+8
Incentives68
Confidence55