AWS: Assuming Access Key Compromise

This Black Hills InfoSec blog demonstrates using Carnal0wnage's weirdAAL toolkit to audit privileges tied to stolen AWS credentials recovered from a compromised domain user; the walkthrough shows the account lacked IAM/root rights but had EC2 and other service access, illustrating how exposed keys can enable cloud reconnaissance and potential misuse.