Update Compromised_IAM_Credentials.md (#13)

https://repost.aws/knowledge-center/potential-account-compromise. AWSExposedCredentialPolicy_DO_NOT_REMOVE is not used in compromise by AWS anymore.
aws-samples · Mar 6, 2024 · bce7a09 · bce7a09
1 parent 7ccb587
commit bce7a09
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/docs/Compromised_IAM_Credentials.md b/docs/Compromised_IAM_Credentials.md
@@ -95,7 +95,7 @@ There are multiple ways to detect compromised credentials within your AWS enviro
 
     1.  identify unusual IAM user creation by looking at creation date and the password last used/changed columns.
     2.  Check if any IAM users have two or more access keys.
-    3.  Check if any IAM users have *AWSExposedCredentialPolicy\_DO\_NOT\_REMOVE* attached. If so, rotate its access keys.
+    3.  Check if any IAM users have *AWSCompromisedKeyQuarantineV2* attached. If so, rotate its access keys.
 
 4.  Review IAM Roles within the AWS account, to identify any unfamiliar roles that have been created or accessed