Wiz
デモを見る

IR Playbook [Template]: Compromised AWS Credentials

Download the template

歩 1 の 3

Key Takeaways
  • 1. Compromised credentials require fast, structured responseThe playbook emphasizes that AWS credential compromise isn’t a single event — you must immediately detect, investigate, contain, eradicate, and remediate using a consistent, repeatable workflow
  • 2. Leverage AWS-native tools for visibility across the incident lifecycleDetection and investigation hinge on Security Hub, GuardDuty, CloudTrail, Trusted Advisor, IAM reports, and Access Analyzer — all used to confirm misuse, identify blast radius, and gather evidence
  • 3. Long-term fixes focus on eliminating root causesEradication and remediation stress removing attacker-created resources, hunting for persistence, patching vulnerabilities, and — most importantly — replacing long-term AWS credentials with temporary, least-privilege access

Who is this template for?

  • Cloud Security Teams: Professionals responsible for securing AWS environments and managing identity risks.

  • DevOps Engineers: Teams involved in managing infrastructure who need clear steps to handle credential-related incidents.

  • Incident Responders: Security teams requiring a structured, AWS-focused approach to handling compromised credentials.

  • Regulated Industries: Organizations with strict compliance needs that must ensure fast, efficient responses to identity-related threats.

  • AWS-Focused Organizations: Companies heavily reliant on AWS for their cloud operations, where compromised credentials can lead to significant operational risks.

What's included?

This playbook template offers a thorough walkthrough of handling compromised credentials in AWS, covering:

  • Detection

    • How to monitor AWS notifications, bills, and GuardDuty findings to identify signs of credential misuse.

    • Tips for leveraging IAM credential reports and Access Analyzer to spot anomalies.

    • Steps for reporting credential compromises to AWS for collaborative threat mitigation.

  • Investigation

    • Using AWS tools like Security Hub, CloudTrail, and IAM Access Advisor to pinpoint the root cause and impact of the compromise.

    • Techniques for building a clear timeline and understanding the blast radius of the incident.

  • Containment

    • Step-by-step guidance for disabling compromised credentials, revoking sessions, and isolating impacted resources like EC2 instances and S3 buckets.

    • Using IAM policies to block unauthorized access quickly and effectively.

  • Eradication

    • How to delete malicious resources and unknown assets created by compromised identities.

    • Checking for signs of persistence to ensure attackers cannot regain access.

  • Remediation

    • Strategies for identifying and patching vulnerabilities that attackers may exploit.

    • Transitioning from long-term credentials to temporary ones to minimize risks.

    • Best practices for preventing similar incidents in the future with IAM role configurations and federated identity access.

パーソナライズされたデモを見る

実際に Wiz を見てみませんか？​

"私が今まで見た中で最高のユーザーエクスペリエンスは、クラウドワークロードを完全に可視化します。"
デビッド・エストリックCISO (最高情報責任者)
"Wiz を使えば、クラウド環境で何が起こっているかを 1 つの画面で確認することができます"
アダム・フレッチャーチーフ・セキュリティ・オフィサー
"Wizが何かを重要視した場合、それは実際に重要であることを私たちは知っています。"
グレッグ・ポニャトフスキ脅威および脆弱性管理責任者
デモを見る

パーソナライズされたデモを見る

実際に Wiz を見てみませんか？​

"私が今まで見た中で最高のユーザーエクスペリエンスは、クラウドワークロードを完全に可視化します。"
デビッド・エストリックCISO (最高情報責任者)
"Wiz を使えば、クラウド環境で何が起こっているかを 1 つの画面で確認することができます"
アダム・フレッチャーチーフ・セキュリティ・オフィサー
"Wizが何かを重要視した場合、それは実際に重要であることを私たちは知っています。"
グレッグ・ポニャトフスキ脅威および脆弱性管理責任者
デモを見る