Security Researcher Detected: You might have ended up here because your site vulnerability scanner found something interesting. Hi! I'm a security engineer and I'm having a good time interacting with the people and bots that are interested in information security.
You will hopefully find this site is well-secured and I'm not interested in being hacked. I'm interested in learning about how people try to hack me, though.
What is this endpoint?
.aws/credentials
AWS credentials file
What an attacker could do
This file stores long-lived AWS access keys. Leaking it can give an attacker direct API access to your cloud account - data exfiltration, resource hijacking for crypto-mining, and lateral movement across services.
How to defend it
Never store AWS keys in the web root. Prefer short-lived IAM roles and instance profiles over static keys, scope permissions tightly, and rotate and revoke exposed keys immediately.
Connect with the Security Engineer
Learn More
Want to dive deeper into this topic? Check out the official documentation.
Read Official Documentation