--- title: Fourth challenge on DevOpsLedger | daily.dev description: A walkthrough of a real AWS security scenario where an EC2 app uses hardcoded long-lived IAM user keys that leaked. The correct fix is not rotating the static... canonical: https://daily.dev/posts/fourth-challenge-on-devopsledger-l6xk0k65f twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Fourth challenge on DevOpsLedger | daily.dev og:description: A walkthrough of a real AWS security scenario where an EC2 app uses hardcoded long-lived IAM user keys that leaked. The correct fix is not rotating the static... og:url: https://daily.dev/posts/fourth-challenge-on-devopsledger-l6xk0k65f og:image: https://api.daily.dev/og/posts/l6XK0K65F.png og:image:alt: Fourth challenge on DevOpsLedger og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Fourth challenge on DevOpsLedger **[Medium](https://daily.dev/sources/medium_js)** · 5 min read · 0 upvotes · 0 comments ## Summary A walkthrough of a real AWS security scenario where an EC2 app uses hardcoded long-lived IAM user keys that leaked. The correct fix is not rotating the static keys but switching to an IAM instance profile with temporary credentials, enforcing IMDSv2 to prevent SSRF-based credential theft, scoping the role with least-privilege policies, and explicitly deleting the leaked keys and the IAM user. The post is structured as a challenge Q&A between a junior and senior engineer, covering the full incident response and architectural remediation. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### If an app on EC2 has leaked long-lived IAM access keys, is generating new keys and putting them in the same config file the right fix? No, rotating to new static keys just resets the timer on the same risk. The correct fix is attaching a least-privilege IAM role via an instance profile so the application gets temporary, auto-rotated credentials instead of static keys stored in a file. The leaked keys must also be explicitly deactivated or deleted, and the old IAM user removed if no longer needed. _daily.dev surfaces practical AWS IAM incident response guidance for engineers hardening EC2 credential handling._ ### Why is IMDSv1 dangerous on an EC2 instance even after switching from static keys to an IAM instance role? IMDSv1 lets any process on the box curl the instance metadata endpoint at 169.254.169.254 and retrieve role credentials without a signed token, so an attacker with limited code execution via SSRF or a compromised dependency can exfiltrate those role credentials just as easily as static keys. Enforcing IMDSv2 requires a session token, closing that exfiltration path. _engineers securing EC2 workloads against SSRF track fixes like IMDSv2 enforcement on daily.dev._ ### How do you scope an EC2 instance role so leaked credentials cause limited damage? Attach least-privilege IAM policies to the role and use condition keys such as aws:SourceArn or ec2:SourceInstanceARN in trust policies to restrict which resources can assume the role or call specific APIs. This limits the blast radius if role credentials are ever exposed, unlike broad long-lived IAM user keys with unrestricted permissions. _those scoping IAM roles for least privilege can find similar AWS security walkthroughs on daily.dev._ ## Similar posts on daily.dev - [AWS Cloud Security Challenge: SSRF, IMDSv2, and Cloud Takeover](https://daily.dev/posts/aws-cloud-security-challenge-ssrf-imdsv2-and-cloud-takeover-eat7eojpd) · InfoSec Write-ups · 0 upvotes · 0 comments - [Rapid7 Labs: Investigating Persistence Mechanisms in AWS](https://daily.dev/posts/rapid7-labs-investigating-persistence-mechanisms-in-aws-qjvpcbpdq) · Rapid7 Cybersecurity Blog · 0 upvotes · 0 comments - [My AWS Account Got Hacked - Here Is What Happened](https://daily.dev/posts/my-aws-account-got-hacked---here-is-what-happened-eg2ax9ikr) · Tech Lead Digest · 13 upvotes · 3 comments - [How a Single Overprivileged Service Turned the LexisNexis Breach Into a Keys-to-the-Kingdom Moment](https://daily.dev/posts/how-a-single-overprivileged-service-turned-the-lexisnexis-breach-into-a-keys-to-the-kingdom-moment-lazovvtmj) · Security Boulevard · 0 upvotes · 0 comments - [You Can't Leak a Key You Never Held](https://daily.dev/posts/you-can-t-leak-a-key-you-never-held-v4tv2u8ax) · strongdm · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws-ec2](https://daily.dev/tags/aws-ec2), [#secrets-management](https://daily.dev/tags/secrets-management), [#aws-iam](https://daily.dev/tags/aws-iam) [View this post on daily.dev](https://daily.dev/posts/fourth-challenge-on-devopsledger-l6xk0k65f) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Fourth challenge on DevOpsLedger","url":"https://daily.dev/posts/fourth-challenge-on-devopsledger-l6xk0k65f","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/fourth-challenge-on-devopsledger-l6xk0k65f"},"datePublished":"2026-07-20T19:34:23.721Z","dateModified":"2026-09-13T19:28:01.572Z","description":"A walkthrough of a real AWS security scenario where an EC2 app uses hardcoded long-lived IAM user keys that leaked. The correct fix is not rotating the static...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"Medium","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Medium","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/medium","url":"https://daily.dev/sources/medium_js"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/fourth-challenge-on-devopsledger-l6xk0k65f","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws-ec2,secrets-management,aws-iam","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Medium","item":"https://daily.dev/sources/medium_js"},{"@type":"ListItem","position":3,"name":"Fourth challenge on DevOpsLedger"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/fourth-challenge-on-devopsledger-l6xk0k65f#faq","mainEntity":[{"@type":"Question","name":"If an app on EC2 has leaked long-lived IAM access keys, is generating new keys and putting them in the same config file the right fix?","acceptedAnswer":{"@type":"Answer","text":"No, rotating to new static keys just resets the timer on the same risk. The correct fix is attaching a least-privilege IAM role via an instance profile so the application gets temporary, auto-rotated credentials instead of static keys stored in a file. The leaked keys must also be explicitly deactivated or deleted, and the old IAM user removed if no longer needed. daily.dev surfaces practical AWS IAM incident response guidance for engineers hardening EC2 credential handling."}},{"@type":"Question","name":"Why is IMDSv1 dangerous on an EC2 instance even after switching from static keys to an IAM instance role?","acceptedAnswer":{"@type":"Answer","text":"IMDSv1 lets any process on the box curl the instance metadata endpoint at 169.254.169.254 and retrieve role credentials without a signed token, so an attacker with limited code execution via SSRF or a compromised dependency can exfiltrate those role credentials just as easily as static keys. Enforcing IMDSv2 requires a session token, closing that exfiltration path. engineers securing EC2 workloads against SSRF track fixes like IMDSv2 enforcement on daily.dev."}},{"@type":"Question","name":"How do you scope an EC2 instance role so leaked credentials cause limited damage?","acceptedAnswer":{"@type":"Answer","text":"Attach least-privilege IAM policies to the role and use condition keys such as aws:SourceArn or ec2:SourceInstanceARN in trust policies to restrict which resources can assume the role or call specific APIs. This limits the blast radius if role credentials are ever exposed, unlike broad long-lived IAM user keys with unrestricted permissions. those scoping IAM roles for least privilege can find similar AWS security walkthroughs on daily.dev."}}]} ```