Question

A security team receives an alert that an IAM user's long-term access key was accidentally committed to a public GitHub repository. AWS also automatically applied an AWSCompromisedKeyQuarantineV2 policy to the user. The team wants to build an automated response so that whenever a similar exposure is detected in the future (via a Health event indicating exposed credentials), the access key is immediately deactivated and the security team is notified—without any manual console interaction. Which approach best meets these requirements?

Accepted Answer

Create an EventBridge rule that matches the AWS Health 'AWS_RISK_CREDENTIALS_EXPOSED' event and targets a Lambda function that calls UpdateAccessKey to set the key status to Inactive and publishes to an SNS topic.

Answer

Enable AWS Config with a managed rule for exposed access keys and configure an automatic remediation action that rotates the key using Systems Manager.

Answer

Schedule a Lambda function with EventBridge to run every five minutes, list all IAM access keys, and deactivate any key older than 24 hours, then send an SNS notification.

Answer

Configure GuardDuty to detect the exposed key and use a Security Hub automation rule to change the finding workflow status, then notify the team through Amazon SNS.