Hundreds of Leaked AWS Keys Give Full Control Over Corporate Accounts

Introduction

A shocking discovery has revealed that hundreds of AWS access keys are publicly exposed and still active — giving hackers full control over corporate cloud accounts.

Security researchers at Truffle Security tracked AWS key exposure for four years and found that 9,300+ AWS access keys were publicly exposed between 2022 and 2026. Of these, 817 keys were linked to companies, and 526 were root keys — the highest privilege level in AWS.

The Scale of the Problem

Here are the key findings from Truffle Security's investigation:

• 431,875 AWS secrets found across code repositories, Git history, datasets, Docker images, and CI logs
• 64,024 unique AWS keys extracted
• 50,654 unique AWS accounts affected
• 10,616 complete credentials that could be re-verified
• 88% of keys were still active and authenticating as of August 10, 2026
• 242 keys had the AdministratorAccess policy — full permissions to create, modify, delete, and view virtually all AWS services
• 17.9% of exposed keys were root keys — the highest-privileged identity

What Are AWS Access Keys?

AWS access keys are credentials used to authenticate and authorize access to Amazon Web Services. They consist of two parts:

• Access Key ID — a unique identifier (like a username)
• Secret Access Key — a password used to sign API requests

These keys allow programs, applications, and developers to interact with AWS services programmatically. They are extremely powerful — with the right permissions, they can do almost anything in an AWS account.

Root keys are especially dangerous because they have unrestricted access to all AWS services and resources in an account. They are not restricted by IAM permissions.

Why This Is Extremely Dangerous

When AWS keys are exposed, attackers can:

• Access and steal data — read, copy, or delete sensitive information stored in AWS
• Take control of servers — launch, stop, or terminate EC2 instances
• Create rogue admin accounts — create new IAM users with full permissions for persistent access
• Deploy cryptominers — use your AWS resources to mine cryptocurrency, running up huge bills
• Exfiltrate data — copy your data to external storage without your knowledge
• Wipe everything — delete databases, files, and entire infrastructure

Real-World Impact: What Hackers Can Do

Scenario 1: Data Theft

• A hacker finds a leaked AWS key in a public GitHub repository
• They use the key to access an S3 bucket containing customer data
• They download millions of customer records and sell them on the dark web
• Your company faces massive fines, lawsuits, and reputational damage

Scenario 2: Cryptomining

• A hacker uses a leaked key to launch hundreds of EC2 instances
• They install cryptocurrency mining software on all of them
• Your AWS bill skyrockets to tens of thousands of dollars overnight
• You only notice when the bill arrives — or when your account is suspended

Scenario 3: Full Account Takeover

• A hacker finds a leaked root key
• They create new IAM users with full permissions
• They lock you out of your own account by changing passwords
• They delete all your data and infrastructure
• Your business is completely destroyed

How AWS Keys Get Exposed

The researchers found that AWS keys were exposed through:

• Public code repositories — developers accidentally commit keys to GitHub
• Docker images — keys embedded in container images
• CI/CD logs — keys printed in build logs
• AI model platforms — Hugging Face was the largest single source, with 8,482 unique key exposures
• Datasets — training data containing credentials

How to Protect Your AWS Infrastructure

Follow these steps to secure your AWS environment:

• Delete all root access keys. AWS recommends never creating root access keys. Use IAM users instead.
• Review IAM credentials by age. Identify old keys that haven't been rotated and either rotate or revoke them.
• Rotate keys regularly. Implement a key rotation policy (e.g., every 90 days).
• Revoke exposed keys immediately. If you suspect a key is exposed, delete it and create a new one.
• Configure budget alerts. Set up AWS Budgets to alert you if spending increases unexpectedly — this helps detect cryptomining attacks.
• Use IAM roles instead of long-term keys. For EC2 instances and Lambda functions, use IAM roles with temporary credentials.
• Enable CloudTrail. Monitor API activity to detect unusual behavior.
• Implement least privilege. Only grant the permissions that are absolutely necessary.
• Scan for exposed secrets. Use tools like TruffleHog to scan repositories and detect exposed credentials.
• Treat any credential committed to a public source as compromised. Immediately revoke and replace it.

Amazon's response:

• AWS notifies affected customers when exposed keys are found
• AWS applies quarantine policies to minimize risks
• Customers can report exposed credentials to aws-security@amazon.com

Final Thoughts

The discovery of 9,300+ publicly exposed AWS keys is a wake-up call for every organization using AWS. 526 root keys and 242 AdministratorAccess keys were exposed — each one giving full control to anyone who finds them.

Key takeaways:

• 9,300+ AWS keys were publicly exposed
• 526 were root keys — the highest privilege level
• 242 had AdministratorAccess — full control
• 88% of exposed keys were still active
• Keys were exposed through GitHub, Docker, CI/CD logs, and Hugging Face
• Delete root keys, rotate IAM keys, and set up budget alerts
• Treat any exposed credential as immediately compromised

If you need help securing your AWS infrastructure or want to learn more about protecting your cloud accounts, contact SystemLogicIT for a free security assessment.