Labs / Capstone investigations
A pushed key, then a new admin user
An access key was pushed to a public repository for one afternoon. Find the commit and the key, then use CloudTrail to see who used it, what they created, and how they kept access.
Briefing
A secret-scanning alert fired for the report-gen repository, which was briefly public. The developer says the key only uploads PDFs to one bucket, so the risk is low.
Do not trust "only": check what the key was actually allowed to do and what was done with it. You have a clone of the repo and a CloudTrail export for that IAM user.
ir-ws · Capstone investigations
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.