Suspicious activity

Exposed aws access key was used in attempt to create new login profile

Risk Level

Informational (4)

Platform(s)
  • N/A

Description

Orca detected that an exposed AWS access key was used in attempt to create a new login profile. The operation to create a new login profile resulted in access denied due to AWS prevention policy on exposed access keys. AWS proactively monitors popular code repository sites for exposed AWS Identity and Access Management (IAM) access keys. On detection of an exposed IAM access key, a policy named 'AWSExposedCredentialPolicy_DO_NOT_REMOVE' is assigned to the IAM user in order to notify on the leaked access key. A login profile is created when you create a password for the IAM user to access the Amazon Web Services Management Console. Thus, by creating a new login profile for an existing IAM user, it allows to access the Amazon Web Services Management Console with the user's level of access.
  • Recommended Mitigation

    It is recommended to rotate the exposed AWS access key immediately.