HIGH Cloud Security #AWS #Credential Theft #Cloud Security

Hundreds of Leaked AWS Keys Expose Corporate Cloud Accounts

2026-08-21 16:21 UTC 3 min read Runtime Rebel Intel

This article was written by a language model from the source above and was not reviewed by a human before publication. Verify anything operational against the original. Editorial policy

Key points

Immediate impact: over 9,300 publicly exposed AWS access keys remain active, granting full control over corporate cloud environments.
Affected systems: Amazon Web Services accounts, IAM user profiles, and root accounts embedded within public code repositories and CI logs.
Remediation: delete all root access keys, rotate exposed credentials immediately, and configure cloud budget alerts to detect anomalous resource consumption.

A multi-year investigation by Truffle Security has uncovered thousands of active Amazon Web Services (AWS) access keys exposed across public code repositories, Git histories, datasets, Docker images, and CI logs. According to BleepingComputer, researchers tracked over 9,300 active and valid AWS access keys between August 2022 and August 2026. The findings highlight severe risks associated with credential leakage and poor secret management in enterprise cloud environments.

Technical Analysis of Exposed AWS Credentials

Out of the extracted data, researchers identified 817 keys linked directly to corporate entities, including 526 AWS root keys and 242 Identity and Access Management (IAM) user keys possessing the AdministratorAccess policy. This level of privilege grants full control to create, modify, delete, and view virtually all AWS services and resources within a compromised account.

Key findings from the analysis include:

High Privilege Exposure: Of the live keys providing full account control, 526 were root keys which bypass standard IAM restrictions.
Lack of Rotation: For keys with available creation dates, the median age was 1,831 days, and only 13.7% had an associated newer access key, indicating a widespread failure to rotate credentials.
Source Distribution: Hugging Face accounted for the largest single source of leaked keys, representing 8,482 unique key exposures, of which 17.9% were root identities.

Full administrative access to an AWS account allows malicious actors to exfiltrate or wipe stored data, manipulate cloud infrastructure, and establish persistent access by creating rogue administrator accounts. Furthermore, threat actors frequently leverage compromised cloud infrastructure to deploy cryptominers, generating catastrophic financial losses for organizations. Notably, Truffle Security discovered that only 262 of 2,754 readable accounts maintained active budget alerts to detect unusual billing spikes.

Mitigations and Remediation Steps

Security teams must treat any credential committed to a public source as definitively compromised. Organizations operating in cloud environments should prioritize the following defensive measures:

Delete Root Access Keys: Eliminate long-lived root access keys entirely and rely solely on multi-factor authentication for necessary root-level tasks.
Audit IAM Permissions: Regularly review IAM credentials by age and scope, enforcing the principle of least privilege across all user and service roles.
Implement Secret Scanning: Integrate automated secret detection tools into CI/CD pipelines to prevent developers from committing credentials to public or internal repositories.
Configure Billing Alerts: Establish automated budget alerts and anomaly detection to identify unauthorized resource provisioning, such as unexpected cryptomining workloads.

#AWS #Credential Theft #Cloud Security #IAM #Data Breach

X/Twitter LinkedIn Reddit HN

← Back to Articles