CISA Contractor AWS GovCloud Credential Leak

Technical Analysis

The exposure involved long-lived AWS GovCloud access keys and other sensitive secrets (potentially including API tokens, config files, or internal credentials) committed to a publicly accessible GitHub repository, a common vector for automated credential-harvesting bots that continuously scan public commits. Because the keys were intentionally posted rather than accidentally committed, this incident also raises insider-threat and contractor-vetting concerns beyond typical secret-scanning failures. If any of the exposed credentials granted access to systems hosting LLM API keys, model endpoints, or agent orchestration infrastructure (e.g., automated pipelines, CI/CD secrets used by AI agent deployments), threat actors could pivot to exfiltrate data from or hijack AI agent tooling and RAG pipelines connected to GovCloud resources.

Affected Systems

AWS GovCloud accounts and associated IAM credentials managed by the CISA contractor; public GitHub repositories used by the contractor; potentially connected internal CISA systems and third-party integrations relying on the leaked keys

Indicators of Compromise

• Public GitHub repository account associated with CISA contractor (specific account not disclosed in source)
• Exposed AWS GovCloud access key IDs/secret keys (not publicly detailed)
• Associated commit history containing agency secrets

Remediation Steps

1. 1

   Rotate and revoke exposed credentials

   Immediately invalidate all AWS GovCloud access keys and any other secrets exposed in the leaked repository, and issue new credentials with least-privilege scopes.

2. 2

   Audit repository and commit history

   Conduct a full audit of the contractor's GitHub account and repository history to identify all exposed secrets, forks, and clones that may retain the leaked data.

3. 3

   Implement secret-scanning and DLP controls

   Deploy automated secret-scanning tools (e.g., GitHub secret scanning, TruffleHog) across all contractor and internal repositories to detect and block future credential exposures.

4. 4

   Review contractor access and vetting policies

   Reassess third-party contractor security clearances, access controls, and code review processes to prevent intentional or accidental leaks of sensitive government data.

5. 5

   Monitor for anomalous cloud activity

   Enable CloudTrail and GuardDuty monitoring on affected AWS GovCloud accounts to detect unauthorized use of potentially compromised credentials.