An attacker used an access key with full privileges to launch an EC2 instance. I deleted the key and the activity stopped, but I don't know how it was exposed. I want to keep learning AWS on the same computer. How can I reduce the risk of this happening again?
How can I prevent another EC2 launch after an access key was compromised?
Asked by
slightly.askew.
Answers
For day-to-day CLI work, use temporary credentials instead of a long-lived access key where you can. IAM Identity Center is one option, with MFA on the identity you use to sign in.
Use a role with only the permissions your current exercise needs, and keep administrative access separate. Temporary credentials can still be misused while they're valid, so limiting their permissions matters too.
Reply to this answer
Check your repositories for exposed secrets, including their history. Removing a key from the current version of a file doesn't remove it from old commits. A secrets scanner such as TruffleHog can help you search.
Also check anywhere else the key might have been stored or shared. The deleted key should stay deleted, and any other credentials you discover were exposed should be revoked or rotated.
Reply to this answer
CloudTrail is a useful place to investigate. Look at the events around the launch, including the access key identifier, source IP and other API calls. That may help establish what the attacker did, though it won't necessarily show how the key was obtained.
The activity stopping after key deletion points toward that key being used. It doesn't prove whether the computer was compromised or the key leaked somewhere else, so I'd avoid treating either explanation as settled.
Reply to this answer
If you really need a long-lived key, don't give it administrator permissions. Give it only the access required for its job and keep it in a secure vault, not in source code. Use separate admin access only when you actually need it.
midair.checkpoint:
Be especially careful about granting IAM permissions. They can allow privilege escalation, so look into permission boundaries if a learning task needs IAM access.
Reply to this answer
Add your answer
Answers are reviewed before publication.
one.dot.more.:
If an exercise needs permission to launch EC2 instances, that permission still carries risk. Remove it when you're done, rather than leaving it on a general-purpose role.