Q: You discover that an IAM access key was accidentally committed to a public GitHub repository. What do you do immediately?

This is a security incident. Move fast — bots scan GitHub and abuse leaked keys within minutes.

• Immediately deactivate the key — IAM console → Users → find the user → Security credentials → Deactivate the access key.
• Create a new key if needed for the application.
• Check CloudTrail — aws cloudtrail lookup-events --lookup-attributes AttributeKey=AccessKeyId,AttributeValue= — see what the key was used for, including any unauthorized usage.
• Assess the blast radius — what permissions did that user have? Audit anything that was changed.
• Rotate any other credentials the user/app might have touched (DB passwords, etc.).

• Delete the key after deactivating and confirming the new key is working.
• Remove the commit from GitHub (history) and notify the GitHub security team if sensitive data was exposed.
• Post-incident — implement pre-commit hooks (ShieldCommit!) to prevent future secret leaks.