// Microsoft Sentinel / Log Analytics. Read-only; not live-tested.
// CloudTrail events signed by the exposed key, or by its IAM user
// (temporary credentials from GetSessionToken keep the user's ARN).
let ExposedKeyId = "REPLACE_WITH_ACCESS_KEY_ID";
let KeyOwnerArn = "REPLACE_WITH_IAM_USER_ARN";
let WindowStart = datetime(2026-01-01T00:00:00Z);  // REPLACE: first possible exposure, UTC
AWSCloudTrail
| where TimeGenerated between (WindowStart .. now())
| where UserIdentityAccessKeyId == ExposedKeyId or UserIdentityArn =~ KeyOwnerArn
| project TimeGenerated, UserIdentityAccessKeyId, UserIdentityType, UserIdentityArn,
    EventSource, EventName, ReadOnly, AWSRegion, SourceIpAddress, UserAgent,
    ErrorCode, RecipientAccountId
| order by TimeGenerated asc
| take 500