AWSCompromisedKeyQuarantineV3 is an AWS managed policy used to restrict selected actions after AWS identifies compromised or publicly exposed IAM credentials. It is a targeted containment measure, not a universal kill switch or a complete fix: AWS tells affected customers to leave the policy attached and follow the instructions in their support case while they investigate and secure the account.
What AWSCompromisedKeyQuarantineV3 does
AWS describes AWSCompromisedKeyQuarantineV3 as a policy it applies when IAM-user credentials have been compromised or exposed publicly. Its stated aim is to limit potential fraud-related damage and unauthorized charges without impacting existing resources. AWS says the policy may be attached to users, groups, and roles.
As an Amazon Associate I earn from qualifying purchases.
The policy works by denying selected API actions. It is not a blanket deny of every AWS request, and it does not establish that an account is safe. AWS’s policy documentation gives this instruction to affected customers: “Do NOT remove this policy. Instead, please follow the instructions specified in the support case created for you regarding this event.”
What actions the policy restricts
The published policy includes selected actions across services, rather than every action in a service. Examples in the AWS policy reference include iam:CreateAccessKey, iam:CreateRole, iam:UpdateAssumeRolePolicy, ec2:RunInstances, lambda:CreateFunction, and selected S3 operations. These examples illustrate restrictions that can hinder new credentials or roles, changes to role trust, new compute, and some storage activity; they are not the complete deny list.
#1 Best Overall
AWS lists version v3 as the default policy version, last edited March 16, 2026. The default version is the one AWS evaluates. Because the document and its action list can change, check the live policy JSON before relying on a particular action being denied.
What to do when AWS applies the policy
- Keep the policy attached. Do not remove or modify AWS’s incident quarantine as a substitute for the case instructions.
- Open the AWS Support case. Follow the steps AWS provides for the specific event; the policy alone does not explain the full response required for your account.
- Delete the affected long-term access key as soon as possible. AWS Support recommends deleting an exposed key, rather than treating the managed policy as a replacement for revocation.
- Inspect for unauthorized changes. Review service consoles for suspicious resources and activity, particularly EC2 instances and Spot requests, newly created access keys, and IAM users.
- Check billing and usage. Look for unexpected charges and activity that may have occurred before restrictions took effect.
AWS Support’s Exposed Access Keys check looks at popular public code repositories for exposed keys and at irregular EC2 use that may indicate compromise. AWS cautions that the check does not guarantee it will identify every exposed key or compromised EC2 instance. It may temporarily limit creation of some resources to help protect against excessive charges, but AWS says this only partially limits unauthorized usage that may incur charges; it does not make the account secure.
Choose the response for the credential type
Credential revocation is not identical across IAM users, role sessions, Identity Center sessions, and the root user. The correct containment path depends on what was exposed and how access is granted.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall| Credential or session | Containment path | Important scope or limitation |
|---|---|---|
| Long-term IAM-user access key | Delete the affected key, following AWS Support’s incident guidance. | Long-term IAM-user credentials do not expire on their own. Inspect the account for activity and persistence beyond the key itself. |
| Temporary role credentials | Remove the permissions they rely on or revoke the role’s temporary credentials, as appropriate to the incident. | Revoking a role’s credentials affects all sessions for that role. Policy changes can take a few minutes to take effect. |
| IAM Identity Center permission-set session | Revoke the user’s active permission-set session through IAM Identity Center. | Permission-set roles are not edited like ordinary IAM roles. |
| Root credentials | Secure the root credentials and follow AWS’s root-user guidance for the exposed credential type. | IAM policies cannot explicitly deny the root user access. An AWS Organizations service control policy can limit root permissions. |
How temporary credentials and policy changes behave
Temporary credentials and their effective permissions are separate things. AWS evaluates permissions on each request. If all permissions available to a temporary credential are removed, requests using it fail; a policy change may take a few minutes to propagate.
For role sessions, AWS supports revoking temporary credentials. A role-wide revocation is broad and can disrupt legitimate users with active sessions. AWS also describes using condition keys and resource-based policies to target particular sessions or principals. If a resource-based policy independently grants access, an explicit deny in that policy may also be needed. The right option depends on the access path and the disruption a broad response would cause.
Investigate beyond the access key
Stopping future use of one credential does not reveal what an attacker already did or whether another path to access remains. AWS Security Hub describes several possible IAM exposure paths to check; these are investigation possibilities, not proof that every exposed credential was used in each way.
Rank #4
- Look for changed or removed permission boundaries and other restrictions.
- Check for new compute, including instances launched with privileged roles, and inspect existing compute that could have been invoked through its role.
- Review IAM users, access keys, roles, and role trust policies for unexpected creation or changes that could enable continued access or role assumption.
- Investigate possible encryption, deletion, or other changes to data and resources.
- Compare service activity, resource inventory, and billing or usage for unexpected activity.
How to interpret AWS status signals
Trusted Advisor’s exposed-key findings refresh several times daily, but changes may take hours to appear and synchronization of a resolved finding may take up to a week, according to AWS Support. These timings are not guarantees of immediate detection or confirmation that all exposure has been resolved. A clear or resolved status is not a substitute for checking resources, credentials, activity, and billing.
Reduce the chance of another exposed-key incident
AWS recommends using temporary credentials from IAM roles and federated principals instead of long-term IAM-user access keys where possible. Long-term IAM-user and root credentials do not expire automatically, so AWS recommends processes for managing keys, changing passwords, and enabling MFA. MFA adds another layer of protection if credentials are compromised, but it does not replace revoking an exposed key or following the quarantine incident instructions.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
