How Should You Handle Leaked IAM Access Keys?
A development team is creating an open source toolset to manage a company's software as a service (SaaS) application. The company stores the code in a public repository so that anyone can view and download the toolset's code. The company discovers that the code contains an IAM access key and secret key that provide access to internal resources in the company’s AWS environment A security engineer must implement a solution to identify whether unauthorized usage of the exposed credentials has occurred. The solution also must prevent any additional usage of the exposed credentials. Which combination of steps will meet these requirements? (Choose two.)
Community Insight
This question tests incident response for leaked IAM credentials, and the trap is assuming IAM Access Analyzer tracks who used a key—it only analyzes resource policies.
Exposed IAM access keys in a public repository require immediate containment and usage review. The correct SCS-C03 response is to deactivate the key and use an IAM credential report to check whether it was used, not to rely on IAM Access Analyzer.
Many candidates choose A, expecting IAM Access Analyzer to show which resources the exposed key accessed, but Access Analyzer identifies externally accessible resources rather than credential usage.
Community Discussion (8 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Deactivating the exposed IAM access key (option B) immediately changes its status to inactive, so any API request signed with that key pair is rejected; this is the fastest containment step and directly satisfies the requirement to prevent additional usage. Generating an IAM credential report (option E) provides the access key's last-used date, region, and service, which lets the security engineer see whether the leaked key was used at all and whether that use occurred after the public exposure. Together these steps address both halves of the question: stop the bleeding and gather evidence of unauthorized activity. The AWS security blog on quickly identifying when an access key was last used supports using the credential report for this exact triage.Why the Other Options Are Wrong
Option A is wrong because IAM Access Analyzer analyzes resource-based policies to identify resources shared with external entities; it does not record which resources a specific access key touched or who used it—CloudTrail is the service for that kind of API activity history. Option C is wrong because GuardDuty can detect anomalous credential use but cannot create a rule that blocks a specific access key from being used; blocking is done by deactivating or deleting the key. Option D is wrong because issuing a new access key does not invalidate the exposed key, so the leaked credential can continue to be used until it is deactivated or deleted. Option E's credential report is imperfect for detailed forensics, but it is the only offered mechanism that checks whether the exposed key was used, which is why it pairs with B.Community Comment Notes
Commenters split between AB and BE, but the BE camp correctly focused on containment and key usage. As libz noted, the credential report "shows last login activity but doesn’t provide detailed resource access analysis," which is why it is a triage check rather than full forensics. Man_Kind argued that Access Analyzer does not tell you who did what and when the credential was last used, and 7f6aef3 explained that Access Analyzer identifies external access while CloudTrail is needed for credential usage. bigdata2ml pointed to an AWS blog showing that the credential report can quickly identify when an access key was last used, reinforcing option E.Official Reference
Exam Strategy
When you see leaked IAM credentials, immediately look for an option that disables or deletes the key, then pair it with a usage-review mechanism such as the credential report or CloudTrail. Eliminate options that claim Access Analyzer or GuardDuty can track or block credential usage.
Frequently Asked Questions
Why is IAM Access Analyzer wrong for checking who used the exposed key?
IAM Access Analyzer evaluates resource policies to find external access; it does not log API calls or identify the principal behind a credential's use. CloudTrail or the credential report is appropriate for usage review.
Does deactivating the access key delete it permanently?
No. Deactivation sets the key to Inactive so API calls fail, but the key remains listed; you can delete it later after investigation.
Related Analysis
Practice All SCS-C03 Questions
Access 86 questions with complete answers and detailed explanations.
View Full SCS-C03 Practice Test →