Credential Compromise

Credential Compromise occurs when AWS credentials (access keys, secret keys, session tokens, console passwords) are exposed to unauthorized parties. This is the most common and dangerous AWS security incident.

How Credentials Get Compromised

• Git Commits: accidentally pushed to public repositories (GitHub, GitLab)
• SSRF Attacks: exploiting IMDSv1 to steal EC2 instance role credentials
• Logs: credentials printed in application logs or CI/CD output
• Phishing: social engineering targeting console passwords
• Malware: credential-stealing malware on developer machines
• Third Parties: shared credentials with contractors or SaaS services

Immediate Response

1. Disable the compromised credentials (deactivate access key, revoke sessions)
2. Assess impact via CloudTrail - what did the attacker do?
3. Contain: apply deny-all policy to the compromised identity
4. Eradicate: remove any backdoors (new IAM users, roles, policies created by attacker)
5. Recover: rotate all related credentials, restore any modified resources