The upload key, used from somewhere new
An access key that only uploads reports from CI was used with the AWS CLI from an unknown address. Use jq on CloudTrail to see what it tried, what was denied, and what it read.
Briefing
The report-uploader user exists for one job: the nightly CI run puts PDFs into acme-reports-prod from 34.250.10.20. Its access key was in a repository that briefly went public on Mar 13.
Every CloudTrail record has sourceIPAddress, userAgent, eventName, and errorCode when the call failed. jq can group and filter them.
cloud-shell · Cloud logs
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.