Thanks for sharing. Did you also investigate what they actually did with the keys?
BTW. GitHub (apart from GitGuardian) also has Secret Scanning feature [1] that basically allows the provider to act on the leaked secret. Amazon is integrated and it should invalidate and inform the owner but this also went to Thinkst, not me, so I don't know if it was actually invalidated and alerted.
[1] https://developer.github.com/partnerships/secret-scanning/