---
title: "Incident Response Playbook — IAM credential exposure Cheat Sheet | Cybr"
description: "What do you do if you find out your AWS IAM access keys have been exposed and exploited by a threat actor? Here's your cheat sheet playbook"
url: https://cybr.com/cheat-sheets/iam-credential-exposure/
---

# Incident Response Playbook **IAM credential exposure**

[https://cybr.com](https://cybr.com/) [Christophe Limpalair](https://www.linkedin.com/in/christophelimpalair/)

 [ **Cybr**](https://cybr.com/)

## High-level goals:

**Identify -**

Vulnerabilities exploited

Exploits & tools observed

Actor’s intent

Actor’s attribution

Damage inflicted to the environment & business

**Recovery point** - Returned to original configuration + hardened

## Common IAM Roles used:

 SecurityAnalystRole

- For Athena queries
- To perform analysis tasks

 SecurityDeployRole

- For resource deployment using CloudFormation/AWS CDK app/etc...

 SecurityBreakGlassRole

- To contain and eradicate without requiring root

## Response Steps:

### \[ANALYSIS\] Validation - Validate alert by checking ownership of exposed credential

```
1 aws sts get-access-key-info \
2     --access-key-id AKIAIOSFODNN7EXAMPLE \
3     --profile SecurityAnalystRole \
4     --region us-east-1
5 {
6     "Account": "777777777777"
7 }
```

Is it your account? If not, contact the AWS Trust and Safety Team

### \[ANALYSIS\] Scope - Gather info about what’s happened, inventory resources involved, determine it’s not a false-positive

Using the SecurityAnalystRole, retrieve activity for past x days related to the affected IAM Access Key ID

Depending
on context

**Depending on results, dig deeper** ie: if S3 permissions were modified, retrieve and inventory them

### \[ANALYSIS\] Impact - What’s the business impact?

- Based on concrete data, determine the business disruption
- Answer questions like:
  1. What related alerts were triggered?
  2. What is the classification of the data accessed?
  3. What AWS services are not in the approved use list?
  4. What AWS service configs were changed?
  5. What guardrails were disabled or modified?
  6. Was the actor an insider or outsider?
  7. What evidence supports benign and malicious activity?
  8. What’s the impact to business apps and processes?
  9. Is there an indication of data exfiltration?

### \[Containment\]

Containment steps depend on multiple factors, including:

- Potential damage to and theft of resources
- Need for evidence preservation
- Service availability (network connectivity, services provided to external parties)
- Time and resources needed to implement the strategy
- Effectiveness of the strategy (partial or full containment)
- Duration of the solution (emergency workaround to be removed in four hours, temporary workaround to be removed in two weeks, permanent solution, etc...)

**Categories of containment in AWS:**

- **Source containment** - Prevent access from a certain source w/ filtering & routing
- **Destination containment** - Prevent access to a target resource w/ filtering & routing
- **Technique and access containment** - Prevent unauthorized access

Examples:

1**Disable IAM access keys:**

```
1 aws iam update-access-key \
2     --access-key-id AKIAIOSFODNN7EXAMPLE \
3     --status Inactive \
4     --user-name RelatedUsername \
5     --profile SecurityBreakGlassRole
```

2**Verify:**

```
1 aws iam list-access-keys --user-name RelatedUsername
2 {
3     "AccessKeyMetadata": [
4         {
5             "UserName": "RelatedUsername",
6             "AccessKeyId": "AKIAIOSFODNN7EXAMPLE",
7             "Status": "Inactive",
8             "CreateDate": "2021-07-24T02:31:19+00:00"
9         }
10     ]
11 }
```

3**Lock down access of affected IAM Users:**

```
1 {
2     "Version": "2012-10-17",
3     "Statement": [
4         {
5             "Sid": "IamPolicyForContainment",
6             "Action": "*",
7             "Effect": "Deny",
8             "Resource": "*"
9         }
10     ]
11 }
```

4**...**

Whatever other containment steps are needed here depending on the incident

### \[Eradication\]

Delete affected IAM Users, resources, etc... depending on what was affected.
Some resources may require backups first. Apply security updates and hardening

### \[Recovery\]

If needed / as needed (re-create destroyed resources, restore data, etc...)

### \[Post-Incident Activity\]

Recommendations:

- Automate containment and eradication steps with AWS CLI or SDK
- Save queries used for faster future use (Athena queries, for example)
- Eliminate as many long-term credentials as possible and adopt short-term credentials
- Enable alerts based on the creation of long-term access keys/credentials

[More on that here: https://cybr.com/cloud-security/ditching-aws-access-keys/](https://cybr.com/cloud-security/ditching-aws-access-keys/)

Preparation

Detection &
Analysis

Containment
Eradication &
Recovery

Post-
Incident
Activity

## Use this cheat sheet with AI

Copy a ready-to-use prompt into your preferred AI assistant.

Goal

Preview prompt

Prompt

Sources and
more info:

- [**IAM credential exposure playbook:** https://github.com/aws-samples/aws-incident-response-playbooks-workshop/blob/main/playbooks/credential\_exposure/IAM\_credential\_exposure.md](https://github.com/aws-samples/aws-incident-response-playbooks-workshop/blob/main/playbooks/credential_exposure/IAM_credential_exposure.md)
- [**AWS Security Incident Response Guide:** https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/containment.html](https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/containment.html)
- [**NIST 800-61:** https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final)

 [**Learn AWS best practices hands-on:**
https://cybr.com/](https://cybr.com/)

[More cheat sheets](https://cybr.com/cheat-sheets/)