AWS Exposed Keys Alerts

AWSCompromisedKeyQuarantineV2 is the current, accurate policy that AWS applies when compromised keys are detected. The AWSExposedCredentialPolicy_DO_NOT_REMOVE references in documentation are outdated and incorrect. AWS updated their response mechanism but hasn't synchronized all public documentation.

What Actually Happens (Current Behavior) When AWS detects exposed credentials in public GitHub repositories:

1. Detection: AWS continuously scans public GitHub commits for AWS API key patterns
2. Action: AWS performs AttachUserPolicy (not PutUserPolicy)
3. Policy Applied: AWSCompromisedKeyQuarantineV2 (managed policy ARN: arn:aws:iam::aws:policy/AWSCompromisedKeyQuarantineV2)
4. Notification: AWS opens a support case and sends email alerts to account owners

Why the Documentation is Confusing

Outdated References: The AWSExposedCredentialPolicy_DO_NOT_REMOVE policy name appears in:

• AWS Premium Support knowledge center articles (older versions)
• AWS Customer Playbook Framework (community-maintained, not official)
• Third-party detection rules (like Panther Labs) that copied old documentation

AWS's Silent Update: AWS transitioned to AWSCompromisedKeyQuarantineV2 around 2021-2022 but:

• Didn't deprecate old documentation references
• Didn't publish a public changelog about the policy name change
• Community resources copied the old name, creating echo chamber effect ​ Why Researchers Have Outdated Information

1. Documentation Decay: AWS updates infrastructure faster than documentation
2. Observability Gap: The quarantine process is automated; few witness it live
3. Community Copying: Security researchers reference each other's work without re-validating
4. AWS Silence: No official deprecation notice for the old policy name

Verification You Can Trust Official Sources:

• Current Policy: AWSCompromisedKeyQuarantineV2 - AWS Managed Policy
• Last Updated: October 2, 2024 (includes Bedrock, modern services)
• Policy Version: v5 (actively maintained)

Your Experiment Confirms: Your test with a static key validates the current behavior:

✅ AttachUserPolicy action ✅ AWSCompromisedKeyQuarantineV2 managed policy ✅ Support case created automatically

What Should AWS Fix?

1. Audit and update all Premium Support articles referencing the old policy name
2. Add redirect notice in old documentation pointing to current policy
3. Publish changelog explaining the 2021-2022 transition
4. Notify security partners (like Panther Labs) to update detection rules

Bottom Line for Security Teams: Trust your empirical testing over dated documentation. The AWSCompromisedKeyQuarantineV2 policy is actively maintained and was last updated in October 2024 to include modern services like Bedrock. If you're building detection rules or incident response playbooks, reference the managed policy ARN, not the policy name, to future-proof your automation.