Tag
An AWS IAM user is creating keys and applying encryption policies without multi-factor authentication (MFA), potentially indicating an attempt to establish persistent access and bypass security controls.