operational guidance, drawn from Arctic Wolf Labs' AntiFox defensive considerations (Nov 10, 2026)
Tip: alert when an AWS secret is read from somewhere new, and stop keeping cloud keys in web.config
Alert: successful secretsmanager:GetSecretValue from an IP or ASN the identity has not used before, especially after a burst of AccessDenied errors.
Alert: one source using several access keys or roles within minutes.
Turn on: CloudTrail management events everywhere, S3 data events and versioning (Object Lock for critical buckets) so deletions can be seen and undone.
Clean up: move AWS keys and database passwords out of web.config, app settings and debug logs; prefer instance roles with IMDSv2 and a hop limit of 1.
Trim: application identities rarely need account-wide List permissions; remove them.