Incident report: stolen AWS access keys

This report describes an incident where stolen long-term AWS access keys—discovered in a publicly exposed Postman project—were used from a hosting-provider IP and multiple access keys to access a customer’s AWS account, primarily targeting Amazon SES APIs; the SOC detected the activity via anomalous aws-cli user agents and IP enrichment, remediated by disabling keys and resetting credentials, and produced hunting/detection guidance (e.g., alert on multiple GetCallerIdentity calls from the same IP across different access keys and monitoring email-related API calls).