--- title: "My AWS IAM access keys were exposed & exploited…what should I do? [Cheat Sheet] - Cybr" description: "What do you do if you find out your AWS IAM access keys have been exposed and exploited by a threat actor? Here's your cheat sheet playbook" url: https://cybr.com/cloud-security/my-aws-iam-access-keys-were-exposed-what-should-i-do-cheat-sheet/ --- # My AWS IAM access keys were exposed & exploited…what should I do? \[Cheat Sheet\] My AWS access keys were exposed and are being exploited by a threat actor. What do I do? Step 1: Don’t panic. Here is the incident response playbook. Christophe Published January 16, 2024 · Updated October 27, 2026 My AWS access keys were exposed and are being exploited by a threat actor. What do I do?!?! Step 1: Don’t panic! There are playbooks that can help you in this situation, and this post walks through the one AWS wrote for exactly this scenario. ## Cheat sheet ## Incident Response Playbook **IAM credential exposure** [https://cybr.com](https://cybr.com/) [Christophe Limpalair](https://www.linkedin.com/in/christophelimpalair/) [ **Cybr**](https://cybr.com/) ### High-level goals: **Identify -** Vulnerabilities exploited Exploits & tools observed Actor’s intent Actor’s attribution Damage inflicted to the environment & business **Recovery point** - Returned to original configuration + hardened ### Common IAM Roles used: SecurityAnalystRole - For Athena queries - To perform analysis tasks SecurityDeployRole - For resource deployment using CloudFormation/AWS CDK app/etc... SecurityBreakGlassRole - To contain and eradicate without requiring root ### Response Steps: #### \[ANALYSIS\] Validation - Validate alert by checking ownership of exposed credential ``` 1 aws sts get-access-key-info \ 2 --access-key-id AKIAIOSFODNN7EXAMPLE \ 3 --profile SecurityAnalystRole \ 4 --region us-east-1 5 { 6 "Account": "777777777777" 7 } ``` Is it your account? If not, contact the AWS Trust and Safety Team #### \[ANALYSIS\] Scope - Gather info about what’s happened, inventory resources involved, determine it’s not a false-positive Using the SecurityAnalystRole, retrieve activity for past x days related to the affected IAM Access Key ID Depending on context **Depending on results, dig deeper** ie: if S3 permissions were modified, retrieve and inventory them #### \[ANALYSIS\] Impact - What’s the business impact? - Based on concrete data, determine the business disruption - Answer questions like: 1. What related alerts were triggered? 2. What is the classification of the data accessed? 3. What AWS services are not in the approved use list? 4. What AWS service configs were changed? 5. What guardrails were disabled or modified? 6. Was the actor an insider or outsider? 7. What evidence supports benign and malicious activity? 8. What’s the impact to business apps and processes? 9. Is there an indication of data exfiltration? #### \[Containment\] Containment steps depend on multiple factors, including: - Potential damage to and theft of resources - Need for evidence preservation - Service availability (network connectivity, services provided to external parties) - Time and resources needed to implement the strategy - Effectiveness of the strategy (partial or full containment) - Duration of the solution (emergency workaround to be removed in four hours, temporary workaround to be removed in two weeks, permanent solution, etc...) **Categories of containment in AWS:** - **Source containment** - Prevent access from a certain source w/ filtering & routing - **Destination containment** - Prevent access to a target resource w/ filtering & routing - **Technique and access containment** - Prevent unauthorized access Examples: 1**Disable IAM access keys:** ``` 1 aws iam update-access-key \ 2 --access-key-id AKIAIOSFODNN7EXAMPLE \ 3 --status Inactive \ 4 --user-name RelatedUsername \ 5 --profile SecurityBreakGlassRole ``` 2**Verify:** ``` 1 aws iam list-access-keys --user-name RelatedUsername 2 { 3 "AccessKeyMetadata": [ 4 { 5 "UserName": "RelatedUsername", 6 "AccessKeyId": "AKIAIOSFODNN7EXAMPLE", 7 "Status": "Inactive", 8 "CreateDate": "2021-07-24T02:31:19+00:00" 9 } 10 ] 11 } ``` 3**Lock down access of affected IAM Users:** ``` 1 { 2 "Version": "2012-10-17", 3 "Statement": [ 4 { 5 "Sid": "IamPolicyForContainment", 6 "Action": "*", 7 "Effect": "Deny", 8 "Resource": "*" 9 } 10 ] 11 } ``` 4**...** Whatever other containment steps are needed here depending on the incident #### \[Eradication\] Delete affected IAM Users, resources, etc... depending on what was affected. Some resources may require backups first. Apply security updates and hardening #### \[Recovery\] If needed / as needed (re-create destroyed resources, restore data, etc...) #### \[Post-Incident Activity\] Recommendations: - Automate containment and eradication steps with AWS CLI or SDK - Save queries used for faster future use (Athena queries, for example) - Eliminate as many long-term credentials as possible and adopt short-term credentials - Enable alerts based on the creation of long-term access keys/credentials [More on that here: https://cybr.com/cloud-security/ditching-aws-access-keys/](https://cybr.com/cloud-security/ditching-aws-access-keys/) Preparation Detection & Analysis Containment Eradication & Recovery Post- Incident Activity ### Use this cheat sheet with AI Copy a ready-to-use prompt into your preferred AI assistant. Goal Preview prompt Prompt Sources and more info: - [**IAM credential exposure playbook:** https://github.com/aws-samples/aws-incident-response-playbooks-workshop/blob/main/playbooks/credential\_exposure/IAM\_credential\_exposure.md](https://github.com/aws-samples/aws-incident-response-playbooks-workshop/blob/main/playbooks/credential_exposure/IAM_credential_exposure.md) - [**AWS Security Incident Response Guide:** https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/containment.html](https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/containment.html) - [**NIST 800-61:** https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final](https://csrc.nist.gov/publications/detail/sp/800-61/rev-2/final) [**Learn AWS best practices hands-on:** https://cybr.com/](https://cybr.com/) ## The playbook for IAM credentials exposure and exploitation AWS has multiple Incident Response playbooks you can access for free and [has one exactly for this scenario](https://github.com/aws-samples/aws-incident-response-playbooks-workshop/blob/main/playbooks/credential_exposure/IAM_credential_exposure.md). These can be helpful in an emergency situation, but also in taking pre-emptive action and in helping you develop your own playbooks. If you subscribe to [AWS Security Incident Response](https://aws.amazon.com/security-incident-response/), you can also open a case from the console to get the AWS Customer Incident Response Team involved, and use its automated triage and containment. At a high level, you want to figure out: - Vulnerabilities exploited - Exploits and tools observed - Actor’s intent - Actor’s attribution - Damage inflicted to the environment and business To ultimately achieve your recovery point: returning to the original plus hardened configuration. The playbook follows the incident handling phases from NIST SP 800-61 (Rev. 2): - Preparation - Detection and analysis - Containment, eradication, and recovery - Post-incident activity NIST replaced that guide with [SP 800-61 Rev. 3](https://csrc.nist.gov/pubs/sp/800/61/r3/final) in 2025. Rev. 3 maps incident response to the NIST Cybersecurity Framework 2.0 functions (Govern, Identify, Protect, Detect, Respond, Recover) instead of prescribing step-by-step handling, but the phases above are still a practical way to work through a credential exposure. This isn’t always a linear process. For example, once you’ve performed basic analysis and identified it’s not a false positive, you may want to contain by disabling exposed credentials before moving on to further analysis. In this playbook, AWS recommends using Amazon Athena for most of the analysis. Athena can perform advanced querying across multiple AWS sources like: - ALB - CloudFront - CloudTrail - GuardDuty - and more Directly from Amazon S3 by using SQL. It basically kind of turns your S3 data into an SQL database without directly modifying the S3 data. Of course, you can use other tools. Maybe you've only got CloudWatch Logs set up for your trail, in which case you may have limited visibility since you may not be pulling the same type of data. Or, maybe you've got a third party SIEM running. ## Common causes of compromised access keys 100% of compromised access keys happen because you're using access keys. This might seem obvious, but you should really be [moving away from using long-term access keys](https://cybr.com/cloud-security/ditching-aws-access-keys/). - Phishing (social engineering in general) - Leaked environment variables - Hardcoded credentials in code - Malware Other possibilities include: - SSRF (Server-Side Request Forgery) - Breached 3rd party - Internal threat actors ## Steps 1. \[ANALYSIS\] Validation - Validate alert by checking ownership of exposed credential 2. \[ANALYSIS\] Scope - Gather info about what's happened, inventory resources involved, determine it's not a false positive 3. \[ANALYSIS\] Impact - What's the business impact? 4. \[CONTAINMENT\] How you contain here depends on a lot of factors, highlighted in the cheat sheet above 5. \[ERADICATION\] ie: delete affected IAM Users, resources, etc... then apply security updates and hardening 6. \[RECOVERY\] If needed / as needed. ie: re-create destroyed resources, restore data, etc... 7. \[POST-INCIDENT ACTIVITY\] Recommendations include automating containment and eradication steps, saving queries used to investigate for future use, eliminating long-term credentials, and enabling additional alerts * * * ## Sources and more info 1. [IAM credential exposure playbook](https://github.com/aws-samples/aws-incident-response-playbooks-workshop/blob/main/playbooks/credential_exposure/IAM_credential_exposure.md) 2. [AWS Security Incident Response Guide](https://docs.aws.amazon.com/whitepapers/latest/aws-security-incident-response-guide/containment.html) 3. [NIST SP 800-61 Rev. 3](https://csrc.nist.gov/pubs/sp/800/61/r3/final) 4. [Beginner's Guide to AWS CloudTrail for Security](https://cybr.com/courses/beginners-guide-to-aws-cloudtrail-for-security/) course 5. [Real-world AWS incident case studies](https://cybr.com/cloud-security/open-source-aws-security-tools/#case-studies) ## Filed under - [Cloud Security](https://cybr.com/cloud-security/) - [Incident Response](https://cybr.com/incident-response-archives/) - [AWS](https://cybr.com/tag/aws/) - [AWS Security](https://cybr.com/tag/aws-security/) - [AWS Security Cheat Sheets](https://cybr.com/tag/aws-security-cheat-sheets/) - [Cheat Sheets](https://cybr.com/tag/cheat-sheets/) - [Cloud Security](https://cybr.com/tag/cloud-security/) - [IAM](https://cybr.com/tag/iam/) ## Comments Loading comments… Recommended resources [![Explore the AWS Certified Security Specialty course](https://media.cybr.com/2023/12/cybr-aws-security-specialty-banner-768x432.jpg)](https://cybr.com/courses/aws-certified-security-specialty-course/) ## Build practical AWS security skills Start with the core services, then prepare for the AWS Certified Security Specialty exam with guided lessons and hands-on practice. [Introduction to AWS Security](https://cybr.com/courses/introduction-to-aws-security/) [Security Specialty course](https://cybr.com/courses/aws-certified-security-specialty-course/)