Skip to content

AWS Secret Access Key

Service Name: Amazon Web Services

Service Description: Amazon Web Services (AWS) is a comprehensive cloud platform offering over 200 fully featured services from data centers globally. AWS provides infrastructure as a service (IaaS), platform as a service (PaaS), and packaged software as a service (SaaS) offerings.

Service Address: https://aws.amazon.com/

Validation Type: API Auth, NHI Enriched

IP Allow list: IP Restriction is available per service using Security Groups, VPCs, and IAM policies with condition keys.

Secret Access Scope: Grants programmatic access to AWS resources and services based on the permissions assigned to the associated IAM user or role. Used in combination with an AWS Access Key ID to authenticate API requests.

Secret Revokement URL: https://console.aws.amazon.com/iam/home#/users

Secret Example: wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

Suspicious Activity Investigation Instructions:

  • Review CloudTrail logs for unusual API calls, resource access, or geographic locations
  • Check AWS Console for unauthorized resource creation or modification
  • Monitor for unusual service usage patterns or unexpected billing increases
  • Examine IAM credential reports for unexpected access key usage
  • Use AWS GuardDuty to identify potential threats and compromised credentials
  • Review AWS Trusted Advisor security recommendations

Mitigation Instructions:

  • Immediately deactivate the compromised access key in the IAM console
  • Create a new access key if still needed before deleting the compromised one
  • Rotate all potentially affected secrets and passwords
  • Review and restrict IAM permissions to follow the principle of least privilege
  • Enable multi-factor authentication (MFA) for all IAM users
  • Implement AWS Organizations service control policies to enforce security

guardrails

  • Consider using temporary security credentials with AWS STS instead of long-

term access keys

  • Set up Amazon CloudWatch alarms to monitor for suspicious activities
  • Implement automated key rotation using AWS Secrets Manager