“AWS applies a quarantine policy to leaked keys without disabling them.”
Truffle found 929 leaked AWS keys that still authenticated with quarantine attached. 894 of them still held grants to read secrets, run commands on servers or delete databases. The policy blocks launching new EC2 instances, the one thing that runs up a bill AWS has to argue about. AWS quarantined its fraud exposure and left yours wide open.