FROM EXPOSURE TO LOCKDOWN: HOW AWS NEUTRALIZES COMPROMISED IAM CREDENTIALS THROUGH MANAGED POLICIES

Summary from the TLDR InfoSec newsletter

AWS automatically attaches the AWSCompromisedKeyQuarantineV3 managed policy to an exposed IAM user within 10 seconds of a public GitHub push, with the CloudTrail AttachUserPolicy event misleadingly attributed to the victim's IAM user rather than to AWS automation. Each policy version tracked real-world attack evolution, with permissions added to block Lambda-based cryptomining, S3 data deletion for extortion, and Bedrock API abuse after Permiso's research exposed unauthorized InvokeModel calls. Security teams should alert on unexpected AttachUserPolicy events in CloudTrail, treat the quarantine event as confirmation of active key exposure rather than as resolution, and rotate all affected credentials before removing the policy.