Scenario · Beginner

Leaked Key

It's 16:40 UTC on 14 September 2026. GitHub's secret scanning has just emailed Acme's security team: an AWS access key belonging to developer dev-jordan was pushed to a public repository at 13:02 UTC.

Nobody has revoked the key yet, and Jordan insists they've only been at their desk in the office today. You have the account's CloudTrail logs for the whole day. Work out whether the key was abused, what the attacker did, and what was taken.

Log Hunter

Loading CloudTrail logs into your browser…

Investigation questions

1. Which access key ID was leaked and used by the attacker?
2. From which IP address did the attacker operate?
3. The attacker created an IAM user for persistence. What is its name?
4. Which AWS managed policy did the attacker attach to that user?
5. Which S3 bucket did the attacker steal data from?
6. How many distinct objects did the attacker download?