ZEKASTRA case pack VP-08 - Leaked AWS access key and a storage leak - SYNTHETIC TRAINING DATA
The company, people, accounts, keys, buckets and times are invented. The AWS account number and the key identifiers follow the AWS documentation examples, IP addresses are from documentation ranges (RFC 5737) or private space (RFC 1918), and domains end in .example (RFC 2606).

Scenario (EN)
Lodos Lojistik A.S. runs its customer portal on AWS. Its build pipeline deploys with the IAM user ci-deploy, whose long-term access key has not been rotated since June 2024. Overnight a code host warned that the key had been published in a public repository. The company asks: was the key used by anyone else, what could that person reach, which customer files left, where are they now, and is anything still open?

Senaryo (TR)
Lodos Lojistik A.Ş. müşteri portalını AWS üzerinde çalıştırır. Derleme hattı, uzun süreli erişim anahtarı Haziran 2024'ten beri değiştirilmemiş ci-deploy IAM kullanıcısıyla dağıtım yapar. Gece bir kod deposu hizmeti anahtarın herkese açık bir depoda yayımlandığını bildirdi. Şirket soruyor: anahtarı başka biri kullandı mı, o kişi nelere ulaşabildi, hangi müşteri dosyaları çıktı, şimdi neredeler ve açık kalan bir şey var mı?

Files
cloudtrail-events.jsonl      CloudTrail records, one JSON object per line, UTC.
s3-access-logs.log           S3 server access logs of two buckets, UTC.
iam-credential-report.csv    IAM credential report at 08:40 UTC on 8 August.
gizli-anahtar-uyarisi.txt    The code host's notice. LOCAL time UTC+3.
export-metadata.txt          Window, time basis and scope of every export. Read it first: data events cover one bucket only.
acquisition-log.txt          What was collected, when and how.
manifest.txt                 SHA-256 of every file above.

Rules
1. Verify every file against manifest.txt before you read anything else.
2. Write the time basis next to every time you copy out. Convert to UTC before you compare two sources.
3. A role session is not a new person: follow the access key ID from AssumeRole to the records that use it.
4. A record that was refused is still a record. Count what succeeded separately from what was tried.