AWS KEY QUARANTINE IS NOT REVOCATION

Summary from the TLDR InfoSec newsletter

When AWS detects leaked keys, it will apply a quarantine policy to the IAM user associated with the key that denies certain sensitive actions. Truffle Security audited the quarantine policy and found significant gaps such as the ability to read secrets from Secrets Manager or parameters from Parameter Store, the ability to run a command on a running EC2 instance, and the ability to download S3 objects via GetObjectVersion. Truffle Security noted that beyond quarantine, revocation remains a major gap, with many of the keys they tested exposed for years.