768 Leaked Corporate AWS Keys Remain Active With Full Administrator Access

A new cloud security investigation from Truffle Security has found that 768 publicly exposed AWS credentials still provide full administrative control over corporate AWS environments.

The findings highlight a persistent failure in credential rotation, secret management, and cloud account monitoring. Truffle Security re-verified 10,616 leaked AWS credential pairs on August 10, 2026, after locating them in public sources between August 2022 and August 2026.

These sources included Git history, Hugging Face datasets, Docker images, package registries, and CI/CD logs. About 88% of the tested credentials still authenticated successfully, showing that exposed cloud keys often remain usable long after their initial leak.

Of the active corporate-linked credentials, 526 were AWS root access keys, and 242 belonged to IAM users with the powerful AdministratorAccess policy. Both credential types can effectively provide complete control of an AWS account.

Root keys are especially dangerous because they cannot be restricted through IAM policies and can perform critical account-level actions, including changing security settings or closing the account.

768 Leaked Corporate AWS Keys Remain Active

Truffle Security found 64,024 unique AWS key pairs in 431,875 public findings, including 10,000+ root credentials. The median leaked key was five years old, with the oldest dating back 17.4 years.

Credential rotation was also uncommon. Among 2,903 keys that allowed access-key enumeration, only 13.7% had a newer replacement key available. This means most of the exposed credentials had never been rotated, revoked, or removed after becoming public.

A leaked key does not become safe simply because the original file is deleted. Public repositories can be cloned, archived, indexed, copied into container images, or included in machine-learning datasets.

The investigation found that 43% of keys had appeared in more than one location, allowing exposure to spread far beyond the original commit.

Hugging Face was the largest single source of exposed AWS credentials in the dataset. Researchers found 8,482 unique active keys across 3,394 public datasets.

Around 17.9% of those keys were root credentials, the highest share of root keys among tracked sources. Many datasets appear to contain snapshots of public source code repackaged for training or development purposes.

This creates a long-term exposure problem: an AWS key accidentally committed years earlier can be redistributed through downstream datasets and projects even after it has been removed from the original repository.

The investigation also found weak cloud cost monitoring. Of 2,754 accounts for which budget information could be read, only 262, or 9.5%, had a budget alert configured. The median configured budget was only $8.

Although the median account spend was low, 50 accounts spent more than $1,000 in the previous month, and 9 spent more than $10,000. Exposed keys could be abused for cryptomining, resource deployment, data theft, or further access into cloud environments.

Organizations should immediately remove all root access keys, rotate any IAM keys that have been exposed or are no longer necessary, and enforce a short maximum key age.

Teams should also scan Git history, container images, CI logs, package registries, and public datasets rather than checking only current source code. AWS accounts should use least-privilege IAM roles instead of long-lived access keys, particularly for production workloads.

Security teams should configure budget alerts and investigate any IAM user with the AWSCompromisedKeyQuarantine policy, which may indicate that AWS has already identified an exposed credential.

The research coincides with the launch of TruffleHog AWS Analyze, a capability designed to identify what an exposed AWS credential can access, including attached policies, groups, roles, and trust relationships.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post 768 Leaked Corporate AWS Keys Remain Active With Full Administrator Access appeared first on Cyber Security News.