CISA details AWS GovCloud key leak from contractor’s GitHub

CISA’s July 9 after-action report is useful because it names the control conditions around the credential exposure. The post, covered by Inside Cybersecurity, addresses a May 19 Krebs on Security report that a CISA contractor stored privileged access credentials for Amazon Web Services GovCloud (AWS GovCloud) and multiple internal agency systems in a public GitHub repository. CISA says it opened an internal response May 15 after notification that internal AWS GovCloud keys and other information were public.

According to CISA, the individual uploaded copies of a CISA build and deployment repository to a personal GitHub account for the purpose of creating cloud infrastructure autonomously. The agency took the public repository and its development environment offline, reset associated credentials, revoked the individual’s system access and rotated all access credentials across environments where the contractor was an administrator. CISA says log forensics showed the leaked credentials were not used outside its environments and no customer or mission data was exposed.

The report’s harder value is in the controls CISA says it changed. CISA users had the ability to upload to public repositories, so the agency revised allow and deny lists for code repositories, limited users’ ability to upload to public code repositories and chose its endpoint detection and response tool to monitor and manage uploads after reviewing its Zero Trust tooling. The agency also says its incident reporting channels were not well defined, which sent the researcher through multiple routes. For teams with contractor developers, personal repositories and cloud keys, the checklist is plain: block the upload path, scope admin credentials and make reporting intake findable.