AWS GovCloud Credential Leak Prompts CISA to Publish Key Cyber Incident Lessons

The Cybersecurity and Infrastructure Security Agency (CISA) has publicly detailed an internal security incident involving the exposure of AWS GovCloud credentials in a public code repository, offering rare transparency into how a federal agency handles its own cybersecurity failures. The incident began on Friday, May 15, when an investigative reporter contacted CISA about internal AWS […] The post AWS GovCloud Credential Leak Prompts CISA to Publish Key Cyber Incident Lessons appeared first on Cyber Security News.

The Cybersecurity and Infrastructure Security Agency (CISA) has publicly detailed an internal security incident involving the exposure of AWS GovCloud credentials in a public code repository, offering rare transparency into how a federal agency handles its own cybersecurity failures. The incident began on Friday, May 15, when an investigative reporter contacted CISA about internal AWS GovCloud keys found in a publicly accessible repository named “Private-CISA”. A security researcher, whose firm continuously scans public code repositories for exposed secrets, discovered the leak and alerted the reporter; the repository was later found to have been unmonitored since November 2025, meaning roughly six months of continuous exposure. AWS GovCloud Credential Leak Prompts CISA’s Office of the Chief Information Officer moved quickly once notified, taking the repository offline and preserving a forensic copy for analysis. Investigators determined the repository was not part of CISA’s official GitHub organization but a personal account belonging to a contractor. CISA also took its development environment offline, reset associated credentials, and revoked the individual’s system access as an immediate containment step. Forensic analysis revealed that the contractor had uploaded copies of CISA’s build and deployment repository, including Infrastructure as Code and build scripts, to enable autonomous cloud infrastructure creation, and that the exposed files Reportedly included admin credentials for AWS GovCloud servers, along with plaintext usernames and passwords for internal systems. Despite the severity, log analysis confirmed the leaked credentials were never used outside CISA’s environment and that no customer or mission data was compromised. CISA rotated all credentials across every environment where the individual held administrative access rather than limiting the response to the specific keys exposed, and it tightened allow and deny lists for its code repositories while restricting users’ ability to upload to public repositories before restoring development systems. Researchers have argued that the deeper problem was architectural, noting that long-lived static secrets should never exist as durable strings that can be copied into a personal repository. CISA’s after-action review highlighted several strengths, including taking external researcher reports seriously, applying Zero Trust principles to development environments rather than only production systems, and maintaining robust logging that enabled a swift investigation. The agency also acknowledged clear gaps, admitting it lacked a dedicated GitHub and cloud incident response playbook at the time, which delayed early response efforts, and that its reporting channels were ambiguous enough that the researcher had to try multiple avenues. CISA further conceded that cryptographic key rotation took longer than expected given the complexity of its federal and industry interconnections, underscoring the need for mature, well-tested key management capabilities. CISA’s willingness to publish specifics, including its own missteps, reinforces its longstanding message that incident sharing strengthens collective cyber defense. The agency emphasized that a security incident is a matter of “when,” not “if,” and urged other organizations to treat this disclosure as a practical blueprint for hardening development environments, tightening credential management, and clarifying incident-reporting workflows. Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google. The post AWS GovCloud Credential Leak Prompts CISA to Publish Key Cyber Incident Lessons appeared first on Cyber Security News.