Security researchers have claimed that over 9300 leaked AWS keys which surfaced between August 2022 and August 2026 are still active, including hundreds with full admin rights.
Truffle Security said its scanners found 64,024 unique AWS key pairs across 431,875 public findings: git history, Hugging Face datasets, Docker images, package registries and CI logs.
“We took the 10,616 pairs with complete credentials and re-verified them, then enumerated what each key can tell us about its account: key age, attached policies, budgets, and last month’s spend,” the security vendor continued.
“No key material is published, and every owner we could identify is being notified.”
Of the 10,616 pairs, 88% still authenticate. They include 768 corporate AWS keys which have full admin rights, Truffle Security said.
Read more on AWS keys: CISA Details Incident Response to Exposed AWS GovCloud Keys
AWS account takeover could allow malicious actors to steal or delete critical cloud data, or even covertly install cryptocurrency mining software to monetize access that way.
Only 9.5% of keys had a budget alert set up which would flag this kind of activity, the report claimed.
Hugging Face was the largest single source of leaked keys, with 8482 unique live keys discovered across 3394 public datasets – 18% of which had root privileges.
For live keys with creation dates, the median age was around five years, although the oldest was over 17 years.
“Rotation is the rarer event,” the report continued. “Of the keys where we could enumerate the user’s access keys, only 13.7% (398 of 2903) have any newer key alongside the leaked one. The other 86% were never rotated, superseded, or cleaned up.”
Steps to Reduce the Risk of Leaked AWS Keys
Truffle Security urged organizations and individuals to improve key handling in order to minimize security risk, sharing the following advice:
- Delete root access keys, checking every account, including personal ones. The report claimed one in six leaked keys had root privileges
- Sort IAM keys by age using “aws iam list-access-keys” plus a maximum age policy
- Set a budget alarm to catch crypto-mining early. Even a $10 alert would be better than nothing, given that 90.5% of leaked-key accounts have no alert set up
- Treat exposed secrets as permanently compromised: 43% of those discovered by the researchers appeared more than once across repos, datasets, and images
- Watch for the quarantine policy: If AWS attaches “AWSCompromisedKeyQuarantine” to a user, it is saying that the key is public
