Hundreds of Leaked AWS Keys Grant Full Access to Corporate Accounts

Researchers at Truffle Security have reported that over 9,300 Amazon Web Services access keys that ended up in the public domain between August 2022 and August 2026 remain active and functional. The company has been tracking the problem for four years.

Of the keys identified, 817 are tied to specific organizations, and 526 of those are AWS root keys, which carry the highest level of privileges. Another 242 keys belong to IAM users with the AdministratorAccess policy, which grants full rights to create, modify, delete and view virtually all of an account's services and resources. According to the researchers, each of the 768 “live” keys in these sets opens up full control over the company's cloud infrastructure.

The Scale of the Leak

In all, the specialists collected 431,875 AWS secrets from code repositories, Git history, datasets, Docker images, registries and CI logs. After removing duplicates, they isolated 64,024 unique keys belonging to 50,654 accounts. For 10,616 keys they were able to obtain full credentials and run a second check — 88% of them were still passing authentication as of August 10.

The single largest source of leaks turned out to be Hugging Face — a popular platform for sharing AI models and datasets — which accounted for 8,482 unique keys. Of those, 17.9% were root keys.

Keys Nobody Ever Changed

The age of the leaked credentials deserves particular attention. For the 2,903 keys with a known creation date, the median age was 1,831 days — about five years — while the oldest was more than 17 years old. Only 13.7% of records had a newer key belonging to the same user, indicating that most were never rotated.

The consequences of a compromise are severe: an attacker can exfiltrate or destroy data, hijack servers and applications, create hidden administrator accounts for persistent access, or spin up miners and leave the company with a hefty bill. Yet only 262 of the 2,754 readable accounts had budget alerts configured.

The researchers recommend removing all root access keys, reviewing IAM credentials by age, rotating or revoking exposed keys and setting up budget alerts. Any account that has appeared in a public source should be considered compromised. Truffle Security stresses that its testing was limited to reading metadata, and that all identifiable owners were notified of the leak.

Source: Bleeping Computer