768 Leaked Corporate AWS Keys Grant Full Administrator Access

Key Takeaways

• A recent investigation by Truffle Security uncovered 768 corporate AWS keys, publicly exposed and still active, that grant full administrative access to cloud environments.
• These compromised credentials include 526 AWS root access keys and 242 IAM user keys with the AdministratorAccess policy.
• The keys were discovered across various public sources, including Git history and AI/ML datasets, highlighting a widespread failure in credential management and rotation.
• Many of the leaked keys are years old, with limited evidence of rotation or revocation, posing a significant long-term risk for data breaches and unauthorized resource usage.

Hundreds of Leaked Corporate AWS Keys Offer Full Admin Control

A new cloud security analysis by Truffle Security found that 768 corporate AWS keys, publicly available, continue to provide complete administrative control over their respective cloud infrastructures. This discovery underscores critical deficiencies in secret management, credential rotation practices, and cloud account monitoring within numerous organizations.

Truffle Security initiated its investigation by re-validating 10,616 AWS credential pairs on August 10, 2026. These credentials had been initially identified in public repositories between August 2022 and August 2026. The sources of these leaks were diverse, encompassing Git history, Hugging Face datasets, Docker images, various package registries, and CI/CD logs. A concerning 88% of these tested credentials remained active and authenticated successfully, indicating that exposed cloud keys frequently retain their functionality long after their initial exposure.

The Pervasive Threat of Root and Admin Keys

Among the active credentials linked to corporate entities, a significant portion posed severe risks. Specifically, 526 were identified as AWS root access keys, while another 242 belonged to IAM users configured with the highly privileged AdministratorAccess policy. Both categories grant attackers comprehensive control over an AWS account, effectively opening the door to a wide range of malicious activities.

Root keys represent a particularly acute danger because they bypass the restrictions of IAM policies. This allows them to execute critical, account-level operations, such as altering security configurations or even terminating the entire AWS account. The inability to restrict root keys via granular policies makes their exposure an immediate and severe threat.

Truffle Security’s broader scan identified 64,024 unique AWS key pairs within 431,875 public findings, including over 10,000 root credentials. The median age of these leaked keys was five years, with the oldest credential dating back an astonishing 17.4 years. This longevity highlights a systemic problem with the lifecycle management of cloud credentials.

The investigation also revealed a widespread lack of credential rotation. Among 2,903 keys where access-key enumeration was possible, only 13.7% had an available replacement key. This statistic suggests that the majority of exposed credentials were never rotated, revoked, or removed after becoming public, leaving organizations vulnerable for extended periods.

Persistent Exposure Across Multiple Platforms

A crucial finding from the research is that deleting the original file containing a leaked key does not guarantee its safety. Public repositories are frequently cloned, archived, indexed, integrated into container images, and incorporated into machine-learning datasets. The investigation confirmed this risk, finding that 43% of the keys had appeared in multiple locations, demonstrating how exposure can proliferate far beyond the initial commit.

Hugging Face emerged as the single largest source of exposed AWS credentials in the dataset. Researchers uncovered 8,482 unique active keys across 3,394 public datasets hosted on the platform. Approximately 17.9% of these keys were root credentials, representing the highest proportion of root keys among all tracked sources. Many of these datasets appear to be snapshots of public source code, often repackaged for training or development purposes, inadvertently propagating sensitive credentials.

This phenomenon creates a long-term exposure challenge: an AWS key inadvertently committed years ago can be continuously redistributed through downstream datasets and projects, persisting even after its removal from the original repository. This “digital echo” effect significantly complicates mitigation efforts.

Weak Cost Monitoring and Potential for Abuse

The investigation also shed light on inadequate cloud cost monitoring practices. Of 2,754 accounts for which budget information could be accessed, a mere 262 (9.5%) had a budget alert configured. The median configured budget was only $8, indicating a lack of robust financial oversight. While the median account spend was low, 50 accounts had spent over $1,000 in the preceding month, and 9 accounts exceeded $10,000. Exposed keys in such environments could be exploited for cryptomining, unauthorized resource deployment, data theft, or to gain deeper access into cloud ecosystems.

The findings coincide with the launch of TruffleHog AWS Analyze, a new capability designed to identify the scope of access an exposed AWS credential possesses, including attached policies, groups, roles, and trust relationships.

What You Should Do

• Immediately remove all AWS root access keys. Root keys should only be used for a limited set of account management tasks and then secured or deleted.
• Rotate any IAM keys that have been exposed or are no longer necessary. Implement and enforce a short maximum key age policy to ensure regular rotation.
• Conduct thorough scans of all potential exposure vectors, including Git history, container images, CI logs, package registries, and public datasets, not just current source code.
• Adopt the principle of least privilege by using IAM roles instead of long-lived access keys, especially for production workloads.
• Configure comprehensive budget alerts for all AWS accounts and actively monitor for unusual spending patterns.
• Investigate any IAM user flagged with the AWSCompromisedKeyQuarantine policy, as this indicates AWS may have already detected an exposed credential.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.