--- title: Suspicious Tag Movement in AWS’s GitHub Action: What... description: On August 4, 2025, the AWS GitHub Action `configure-aws-credentials` had its v4.3.0 release tag deleted and recreated pointing to a different commit after a... canonical: https://daily.dev/posts/suspicious-tag-movement-in-aws-s-github-action-what-happened-and-why-it-matters-agtoet1yy twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Suspicious Tag Movement in AWS’s GitHub Action: What Happened and Why It Matters | daily.dev og:description: On August 4, 2025, the AWS GitHub Action `configure-aws-credentials` had its v4.3.0 release tag deleted and recreated pointing to a different commit after a... og:url: https://daily.dev/posts/suspicious-tag-movement-in-aws-s-github-action-what-happened-and-why-it-matters-agtoet1yy og:image: https://api.daily.dev/og/posts/AgTOeT1Yy.png og:image:alt: Suspicious Tag Movement in AWS’s GitHub Action: What Happened and Why It Matters og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Suspicious Tag Movement in AWS’s GitHub Action: What Happened and Why It Matters **[StepSecurity](https://daily.dev/sources/stepsecurity)** · 9 min read · 0 upvotes · 0 comments ## Summary On August 4, 2025, the AWS GitHub Action `configure-aws-credentials` had its v4.3.0 release tag deleted and recreated pointing to a different commit after a critical bug was discovered. StepSecurity's Artifact Monitor flagged this tag movement within minutes as suspicious — the same pattern used in real supply chain attacks like the tj-actions and reviewdog compromises in March 2025. The post explains the timeline of the AWS incident, why moving tags are treated as red flags, and how automated monitoring of release tags is essential for CI/CD security. Key recommendations include treating unexpected tag changes as urgent incidents, pinning actions to immutable commit SHAs, and investing in automated release monitoring tools. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [Is GitHub Actions Putting Your Software at Risk?](https://daily.dev/posts/is-github-actions-putting-your-software-at-risk--a2b2a1jji) · Atomic Spin · 0 upvotes · 0 comments - [actions-cool/issues-helper GitHub Action Compromised: All Tags Point to Imposter Commit That Exfiltrates CI/CD Credentials](https://daily.dev/posts/actions-cool-issues-helper-github-action-compromised-all-tags-point-to-imposter-commit-that-exfiltr-12ij52s4u) · StepSecurity · 2 upvotes · 0 comments - [simonecorsi/mawesome GitHub Action has been compromised](https://daily.dev/posts/simonecorsi-mawesome-github-action-has-been-compromised-ckc9svqze) · StepSecurity · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#aws](https://daily.dev/tags/aws), [#cicd](https://daily.dev/tags/cicd), [#github-actions](https://daily.dev/tags/github-actions) [View this post on daily.dev](https://daily.dev/posts/suspicious-tag-movement-in-aws-s-github-action-what-happened-and-why-it-matters-agtoet1yy) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Tag Movement in AWS’s GitHub Action: What Happened and Why It Matters","url":"https://daily.dev/posts/suspicious-tag-movement-in-aws-s-github-action-what-happened-and-why-it-matters-agtoet1yy","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/suspicious-tag-movement-in-aws-s-github-action-what-happened-and-why-it-matters-agtoet1yy"},"datePublished":"2026-03-31T12:25:48.767Z","dateModified":"2026-03-31T12:36:23.356Z","description":"On August 4, 2025, the AWS GitHub Action `configure-aws-credentials` had its v4.3.0 release tag deleted and recreated pointing to a different commit after a...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/064da5f82ac2daf345b1a9bc5afc4354?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/064da5f82ac2daf345b1a9bc5afc4354?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"StepSecurity","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"StepSecurity","logo":"https://media.daily.dev/image/upload/s--vegWii-S--/f_auto,q_auto/v1774959924/logos/stepsecurity?_a=BAMAMiWQ0","url":"https://daily.dev/sources/stepsecurity"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/suspicious-tag-movement-in-aws-s-github-action-what-happened-and-why-it-matters-agtoet1yy","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,aws,cicd,github-actions","timeRequired":"PT9M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"StepSecurity","item":"https://daily.dev/sources/stepsecurity"},{"@type":"ListItem","position":3,"name":"Suspicious Tag Movement in AWS’s GitHub Action: What Happened and Why It Matters"}]} ```