From Exposure to Lockdown: How AWS Neutralizes Compromised IAM Credentials through Managed Policies

This report analyzes the AWSCompromisedKeyQuarantine managed policy and its evolution, describes GitHub's secret scanning partnership and validity checks, presents a real-world test timeline showing automatic attachment of the quarantine policy and associated AWS/GitHub notifications, and provides monitoring recommendations and IOCs (notably STS GetCallerIdentity CloudTrail events, AttachUserPolicy events, and specific GitHub/ST S user-agent patterns) to detect exposed AWS access keys.