Unit 42: AWS attaches CompromisedKeyQuarantineV3 ~10s after public GitHub IAM key leak
Palo Alto Networks Unit 42 (published 21 September 2026) documents how AWS responds when long-term IAM access keys appear in public GitHub repositories via GitHub secret-scanning partner integration. In a controlled Dec 2025 exposure test, AWS attached the AWSCompromisedKeyQuarantineV3 managed policy to the affected IAM user about 10 seconds after the push (CloudTrail AttachUserPolicy), with GitHub email, AWS Health “Risk IAM quarantine” notice, AWS email, and a Support case following within a minute. Quarantine is an explicit Deny on high-risk actions (policy evolved since Aug 2020 through V2/V3 covering IAM/EC2/S3/ECS/ECR/Bedrock and more) — not key disablement or AWSDenyAll — so residual abuse of unlisted actions remains possible until operators rotate/deactivate the key. Monitoring tip: alert on AttachUserPolicy where policyArn contains AWSCompromisedKeyQuarantine{,V2,V3}; note CloudTrail may attribute the attach to the IAM user identity even though AWS automation performed it. Amplify: Cyber Security News 21 September 2026. No CVE.
- Product
- AWS IAM (access keys) + GitHub secret scanning partner integration
- Versions
- AWSCompromisedKeyQuarantine (Aug 2020) → V2 (Apr 2021) → V3 (Aug 2024); behaviour current as of Unit 42 Sep 2026 test write-up
- Exploited in Australia?
- unknown
- Patch to
- Never commit long-term IAM keys; use short-lived roles; alert on AttachUserPolicy for AWSCompromisedKeyQuarantine*; treat quarantine as confirmed exposure — rotate/deactivate the key, review CloudTrail around the leak (incl. GetCallerIdentity with GitHub validation UA), and close the AWS Support case deliberately.
Primary: Unit 42 — From Exposure to Lockdown: AWS Compromised IAM key quarantine (21 Sep 2026) · Vendor: Palo Alto Networks Unit 42 primary research · Cyber Security News — AWS IAM key quarantine amplify (21 Sep 2026)