AWS IAM Compromised Key Quarantine Policy Attached

Google SecOps@GoogleSecOps

•updated Jan 30, 2025•3•0•65

Detects when the AWS managed policy 'AWSCompromisedKeyQuarantine' is attached to an IAM user, role, or group. This policy is typically applied by AWS when credentials for an IAM entity are suspected of being compromised or publicly exposed, indicating a potential security incident.