Over 9,300 Leaked AWS Keys Are Still Active and Valid

Security research firm Truffle Security has released findings from a four-year study showing that more than 9,300 Amazon Web Services (AWS) access keys, exposed publicly between August 2022 and August 2026, remain active and usable today. The firm scraped 431,875 AWS secrets from public code repositories, Git history, Docker images, CI logs, and dataset hosting sites like Hugging Face — which alone accounted for 8,482 unique key exposures. After deduplication, 64,024 unique keys were extracted; of the 10,616 for which full credentials were available for re-verification, 88% were still authenticating as of August 10, 2026.

The most alarming subset: 242 of the live keys belong to IAM users with the AdministratorAccess policy, granting full permissions over an AWS account — the ability to read, modify, delete, or destroy virtually any cloud service or data the account hosts. An additional 526 are root keys, the highest-privilege identity in AWS. Truffle Security notes the median key age for those with known creation dates was 1,831 days — about five years — and fewer than 14% had ever been rotated. Only 262 of 2,754 readable accounts had a budget alert configured, meaning cryptominer deployments that run up massive charges could go unnoticed for weeks. An attacker holding such a key can exfiltrate or wipe cloud-hosted data, pivot to any connected service, and create backdoor admin accounts for persistent re-entry.

How to check if you’re affected

Affected products include any AWS account that stores long-lived IAM or root access keys in source code, Git history, dataset files, Docker images, or CI/CD pipeline configuration. To audit your exposure:

• Sign into the AWS IAM console and review all access keys under IAM → Users → Security credentials. Delete any root access keys (AWS recommends never creating them).
• Filter by creation date and revoke or rotate any key older than 90 days.
• Use AWS Access Analyzer or Trusted Advisor to surface keys with overly permissive policies such as AdministratorAccess.
• Search your repositories and CI logs for strings matching AKIA (long-term key prefix) or ASIA (temporary key prefix) — tools like trufflehog automate this scan.
• Enable AWS CloudTrail and set a billing alert to catch unexpected activity if a key is ever compromised.

Sources

• Hundreds of leaked AWS keys give full control over corporate accounts — BleepingComputer