Access key was quarantined but there was no notice about the action

I believe a support case should've been automatically raised in your account when the initial action involving attaching the policy to the user was taken by AWS. By default, the root email address of the account would be notified of the ticket. The ticket is raised because it contains instructions that you are required to take to release the user from quarantine.

Are you not seeing a support ticket about the quarantining in your account?

There are a few potential reasons why an access key could be quarantined by the AWSCompromisedKeyQuarantineV2 policy without you being notified:

Automated Detection of Suspicious Activity:
    The AWS security systems have algorithms in place to automatically detect suspicious or anomalous use of access keys.
    If the system detects activity that indicates the access key may have been compromised, it can proactively quarantine the key as a precautionary measure, even if there's no clear evidence of a leak.

Insufficient Audit Logging or Monitoring:
    If your AWS account's logging and monitoring configurations are not set up properly, suspicious activity may go unnoticed, leading to a silent quarantine of the access key.
    Ensure that you have comprehensive CloudTrail logging, Amazon CloudWatch alarms, and other security monitoring measures in place to detect and be notified of such events.

Compromised AWS Account or Credentials:
    If your AWS account, root user credentials, or other privileged credentials have been compromised, an attacker could potentially use your access keys without your knowledge.
    In such a scenario, the AWS security systems may quarantine the access key as a protective measure, even if you're unaware of the breach.

Lack of Proactive Key Rotation:
    If you don't have a regular process for rotating your access keys, they may become outdated or exposed over time, leading to a silent quarantine by the AWS security systems.

To address this issue and prevent future occurrences, consider the following steps:

Review CloudTrail Logs: Carefully review your CloudTrail logs to look for any suspicious activity or unauthorized access attempts that may have triggered the quarantine.

Enable Comprehensive Logging and Monitoring: Ensure that you have robust logging and monitoring configurations in place, including CloudTrail, CloudWatch, and other relevant security services. This will help you detect and be notified of any future suspicious activity.

Rotate Access Keys Regularly: Implement a regular process for rotating your access keys, ensuring that any potentially compromised keys are replaced in a timely manner.

Review and Secure Your AWS Account: Thoroughly review your AWS account, including the root user credentials, IAM users, and other privileged access. Ensure that all credentials are secure and that your account is not compromised.

Contact AWS Support: If you have limited information about the quarantine and the reasons behind it, consider contacting AWS Support. They may be able to provide more details and guidance on the specific incident and any necessary remediation steps.

By taking these actions, you can better understand the root cause of the access key quarantine, strengthen your AWS security posture, and be better prepared to respond to any future security incidents.