More than 9,300 Amazon Web Services (AWS) access keys that were publicly exposed between August 2022 and August 2026 are still active and valid, according to research tracked by Truffle Security. The findings show that exposed cloud credentials are remaining usable for years after they first become public. Out of the exposed keys, 817 were linked to companies, while 526 were AWS root keys, making the discovery especially serious for organizations relying on AWS for their cloud infrastructure.
Researchers also identified 242 keys connected to AWS Identity and Access Management (IAM) users that had the AdministratorAccess policy. This permission level can allow an account to create, modify, delete, and view virtually all AWS services and resources. The research found that 768 live keys across the examined groups could provide full control of a company’s AWS account. In the wrong hands, such access could give an attacker extremely broad control over a company’s cloud environment.
The investigation examined secrets found across code repositories, Git history, datasets, Docker images, registries, and continuous integration logs. Researchers discovered 431,875 AWS secrets and identified 64,024 unique AWS keys connected to 50,654 AWS accounts after removing duplicates. A smaller group of 10,616 keys had complete credentials available for re-verification, and 88% of those credentials were still able to authenticate as of August 10, 2026.
Hugging Face was identified as the largest single source of the exposed AWS keys, with 8,482 unique key exposures found across its public material. Researchers also found that 17.9% of those keys were root credentials, which represent the highest-privileged identity in an AWS account and are not restricted by normal IAM permissions. This shows how sensitive credentials can remain exposed in public development and data-sharing environments long after they are originally published.
The potential impact of these credentials is significant because AWS is widely used to host websites, applications, databases, servers, stored data, domains, and other business infrastructure. An attacker who gains full control could potentially access, steal, or delete cloud-hosted information and take control of servers and applications. Attackers could also create unauthorized administrator accounts to maintain access, while compromised accounts could be abused for cryptocurrency mining and other activity that generates unexpected cloud costs.
The research also highlighted a major problem with old cloud credentials. Among 2,903 exposed keys where creation dates were available, the median age was 1,831 days, or roughly five years. The oldest key had existed for 17.4 years, showing that some credentials can remain active for extremely long periods. Only 398 of those entries, equal to 13.7%, had a newer access key linked to the same user, suggesting that most had not been regularly rotated.
Truffle Security said its testing was limited to read-only metadata and that identifiable owners of the exposed credentials were notified. The researchers recommend removing root access keys, reviewing IAM credentials based on their age, and immediately rotating or revoking credentials that have been exposed. They also recommend setting up AWS budget alerts because attackers who gain access can use compromised accounts to launch expensive resources, potentially leaving organizations with large and unexpected bills.
The incident highlights a basic but important cloud security lesson: once an AWS credential is publicly exposed, organizations should treat it as compromised even if it has not yet been abused. Removing the key from a public repository is not enough because copies can remain in histories, datasets, logs, or other locations. Companies need regular secret scanning, strong credential rotation, least-privilege IAM permissions, and safer alternatives such as short-lived identity-based access to reduce the risk of leaked credentials turning into complete cloud account compromises.
Stay alert, and keep your security measures updated!
Source: Follow cybersecurity88 on X and LinkedIn for the latest cybersecurity news
