Time to auto-quarantine a leaked key: 10 seconds (Source: Unit 42, Palo Alto Networks (Sept. 2026))
An Automated Backstop for Leaked AWS Keys
When a long-term AWS access key ends up in a public GitHub repository, Amazon does not wait for the account owner to notice. Unit 42 researchers at Palo Alto Networks tested the response by deliberately exposing a key on the main branch of a public repository and timing what followed. AWS attached its AWSCompromisedKeyQuarantineV3 managed policy to the affected IAM user within 10 seconds, followed a second later by a GitHub notification and, shortly after, AWS Health and Support tickets. The mechanism runs on a standing partnership between GitHub's secret-scanning program and AWS.
A Deny List, Not a Full Shutdown
The policy works by attaching explicit Deny permissions to the compromised identity rather than disabling the access key or account password outright. AWS built it this way to limit business disruption — if the exposed key's normal usage falls outside the denied actions, operations continue. First published Aug. 11, 2020, the policy has since been revised at the major-version level twice, with V2 arriving April 21, 2021 and V3 arriving Aug. 21, 2024, alongside smaller in-between updates. Each addition tracked a specific attack pattern: iam:CreateRole and lambda:CreateFunction after a cryptomining campaign documented on AWS's own security blog, s3:DeleteObject after extortion-driven data deletion reported by InfoRisk Today, and five Amazon Bedrock permissions after research from Permiso on unauthorized InvokeModel calls.
GitHub's Side of the Pipeline
The quarantine only moves as fast as detection allows it to. GitHub's secret-scanning partner program launched in 2018 and extended to AWS in 2020, scanning public repositories and npm packages by default against patterns supplied by more than 200 service partners. GitHub added validity checks in January 2023 to confirm a flagged string is a live credential before alerting the issuer, and push protection in August 2023 to block a commit containing a recognizable secret before it ever reaches a public repository.
What a Budget-Holder Should Ask
The quarantine policy is a safety net for a failure that starts inside engineering workflows, not a substitute for preventing it. It only engages after a key has already surfaced publicly, and because it denies specific actions rather than the credential itself, activity outside the deny list still goes through. Security and cloud engineering leads should be able to answer three questions directly: Do AttachUserPolicy events tied to AWSCompromisedKeyQuarantine feed into our CloudTrail alerting, or would a quarantine event sit unnoticed until a support ticket lands in an inbox nobody monitors? Do our IAM users still carry permissions broader than what the quarantine policy would deny, meaning least-privilege design — not AWS's reaction speed — is our real control? And is push protection turned on for our private repositories, not just the public ones GitHub scans automatically?
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Palo Alto Networks Unit 42.
