AWS has come under fire from cloud commentator Corey Quinn after a Truffle Security report found hundreds of leaked AWS root keys remain active and valid, exposed via public GitHub repositories. Rather than disabling compromised credentials outright, AWS applies a "Quarantine Policy" that blocks a limited set of actions to avoid disrupting legitimate customer workloads, but Quinn argues this half-measure leaves attackers with more than enough access to cause serious harm.

Quinn details how the quarantine policy fails to close off dangerous permissions, including full control over RDS databases, the ability to run root commands on EC2 via SSM, and using sts:AssumeRole to bypass restrictions entirely by assuming other roles. Attackers could also disable CloudTrail logging, send spam or fraudulent texts via SES and SNS, flood S3 buckets with data and lock them using COMPLIANCE-mode Object Lock retention (removable only by deleting the whole AWS account), and read secrets via Secrets Manager, SSM Parameter Store and KMS decryption. Quinn contends AWS's stated aim of not breaking customer environments is misguided given the scale of damage still possible.