> In the email they also give guidance on how to secure the account. They do this in four steps: 1. Rotate and delete the exposed AWS Access Key... I work at a

> In the email they also give guidance on how to secure the account. They do this in four steps: 1. Rotate and delete the exposed AWS Access Key... I work at a very small shop (at a non-profit institution). In the past, when we've accidentally leaked a credential, AWS has required us to rotate all of our AWS Access Keys in the account, not just the exposed one. Which I know ideally rotation would be easy/automated and this wouldn't matter, but at the time it was disruptive for us. And a bit frustrating when we had intentionally created separate AWS credentials with least privs needed for the service, etc. But thinking on it, I guess any given credential might give permissions to create other credentials or other devious things, rotating all of them might be necessary to be safe. It's been a couple years since we had a leaked credential now (hooray). I wonder if the policy has changed, or if I misunderstood, or if in fact you still need to rotate all credentials in the account, maybe OP just only had one credential in the account they were intentionally doing insecure things so the compromised key was in fact all keys. (I don't specifically remember the `AWSCompromisedKeyQuarantineV2` policy, but probably am just not remembering it, I had other things to worry about at the times!)