Consider a cached access key on a single Windows machine. It got there the way most cached credentials do - a user logged in, and the key stored itself automatically. Standard AWS behavior.
When Identity is the Attack Path
Summary + source link. No paywalls, no tracking.