AWS GovCloud Credential Leak Leads CISA to Share Critical Cyber Incident Lessons

CISA disclosed that an employee contractor's public GitHub repository contained Infrastructure-as-Code, build automation scripts, and exposed administrative credentials for AWS GovCloud and numerous internal systems. The agency immediately took the repository offline, revoked access, rotated credentials across affected environments, and strengthened repository controls and incident response playbooks; investigators found no evidence of external misuse or customer data exposure.