I believe for AWS,. If attacker gains your key and generated a STS session key, it used to you can't revoke them (that is revoking me does not revoke the key I

I believe for AWS,. If attacker gains your key and generated a STS session key, it used to you can't revoke them (that is revoking me does not revoke the key I generate from STS)z i don't know if they fixed it or not, I did a test after someone spoke to me about a year ago.