A developer accidentally committed an AWS access key to a public GitHub repo. What do you do?
What they are really testing: Incident response under pressure. The critical signal: rotate first (assume compromised), do not just delete the commit. They want order of operations and prevention.
A real interview question
A developer accidentally committed an AWS access key to a public GitHub repo. What do you do?
What most people say
drag me
“I would remove the key from the repository and force-push to delete it from the history.”
This is the dangerous wrong instinct. The key is already harvested by bots within seconds; deleting the commit does nothing to stop misuse. Without immediate rotation, the account stays exposed.
The follow-ups they ask next
Why is deleting the commit and rotating different in priority?
Rotation stops the active risk; deleting the commit is cosmetic since the key is already harvested. Rotate first, always. Cleaning history is optional cleanup afterward.
How do you stop this from happening again at the root?
Secret scanning + pre-commit hooks to block commits, and eliminate long-lived keys entirely by using role-based short-lived credentials (instance profiles, OIDC for CI), so there is nothing static to leak.
What the interviewer is listening for
- Rotates/revokes first, treats as compromised
- Knows deleting the commit is insufficient
- Checks audit logs for misuse + adds prevention
What sinks the answer
- Deletes the commit as the fix
- Does not rotate immediately
- No audit-log/blast-radius check
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“First [revoke/rotate the key immediately, treat it as compromised, bots find it in seconds]. Know that [deleting the commit is not enough, it is already scraped, only rotation fixes it]. Then [check CloudTrail for misuse and scope the blast radius], [run it as an incident if used], and prevent with [secret scanning, pre-commit hooks, and short-lived role-based credentials].”
Keep going with security
Foundation
Explain the shared responsibility model. Where does the cloud provider's job end and yours begin?
Foundation
What is the CIA triad, and why is it a useful way to think about security?
Foundation
What is the difference between authentication and authorization?
Junior
What is the difference between encryption at rest and in transit, and why do you need both?
Junior
How should an application running in the cloud get credentials to call other cloud services? Why avoid long-lived access keys?
Junior
What is the difference between symmetric and asymmetric encryption, and where is each used?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free