Leaked long-lived AWS creds

Impacted organization discovered that long-lived AWS creds had leaked. Initially alerted to the following suspicious activity:

• Successful authentication to AWS API from unusual location (outside AWS) and/or with suspicious user agent ('aws-cli/kali').
• Attempted CreateUser API call and user account enumeration resulting in "access denied”.

Follow-up investigation into CloudTrail logs showed compromise of multiple IAM accounts and evidence of leakage of long-lived access keys.