Does this work at the system call level, where it would detect e.g. any attempt to open ~/.aws/credentials, or does it rely on heuristic analysis of the code itself, which will always be able to be "coded around" by the malware authors?
The correct approach would seem to be to not run untrusted code in an environment where it can read your AWS credentials.
The correct approach would seem to be to not run untrusted code in an environment where it can read your AWS credentials.