What?I was working on setting up VPC using Terraform on AWS, later I pushedthose codes into the my GitHub, but accidently I pushed my AWS keys too!And I was totally unaware it.
MeantimeI took a good 1 hour break for my lunch after pushing the code.Immediately I got a mail from GitHub which said "Aws apikey exposed onGitHub" and a call for an alert, which I dint give much attention to inmy sweet time. ("I am Never gonna do that again for sure !!!")
Back to deskI came back to check my mail wondering what kind of number was that?I had recieved mails from AWS too, which said "Irregular activityin your AWS account"and I was like "Its just me dude eperimenting!!!"I logged into AWS account - BOOM!!! I saw someone has hacked into itand has ran more than 20 instances in all the provided regions in AWS.Whaaaat? How did this happened? What more this person could do? Whywould someone do it? so many questions in my mind.All these happened when I pushed my keys:Access key id and secrectaccess key into GitHub. Using these someone barged into my AWS, and myIAM user had admin privilages which gave all the permissions to get thethings done.I was completely blank and had no idea what worse can come nor I knewwhat to do.
ActionsHere is what I did.a. Deleted the repository on github where I had pushed AWS keysUnfortunately this isn't sufficient enough.b. Changed Amazon root passwordc. Deleted IAM userd. Created new IAM user to delete all the resources that were created.e. Deleted the key from the root account.
