More than 9,300 AWS keys that were previously made public were found to still be working this month. Hundreds of them are linked to companies and provide extensive access to cloud environments. Some of the leaked credentials have been known for years but have never been replaced.
This is according to a study by Truffle Security on AWS credentials found in public locations between August 2022 and August 2026. The company found 431,875 AWS secrets in repositories, Git history, datasets, Docker images, and CI logs, among other places.
After removing duplicates, 64,024 unique AWS keys from 50,654 accounts remained. For 10,616 of these keys, the researchers had sufficient data to test whether they were still usable. As of August 10, 88 percent of them, or more than 9,300 keys, were still active.
Full control over accounts
Some of these credentials pose significant risks. According to BleepingComputer, 817 active keys could be linked to companies. These included 526 root keys and 242 IAM keys with AdministratorAccess. In total, 768 credentials could grant full control over an AWS business account.
With such privileges, an attacker could, for example, access or delete data, take over servers and applications, and create new accounts with administrator privileges. AWS resources could also be used for cryptomining, with the owner footing the bill. Of the 2,754 accounts examined, only 262 had set up a budget alert.
The investigation also shows that keys can remain active for a long time. Truffle Security determined the creation date for 2,903 keys. The median age was approximately five years, and the oldest key had been in existence for 17.4 years. Only 13.7 percent had a newer access key for the same user, indicating that many credentials have never been rotated.
Notably, 929 credentials had already been flagged under AWS’s policy for compromised keys. Some had been detected more than three years earlier but could still be used for authentication.
AWS states that it alerts customers when it discovers exposed keys. The cloud provider can also apply quarantine policies to mitigate risks without immediately disrupting customers’ systems. Under the shared-responsibility model, customers are responsible for managing and replacing their own credentials.
Hugging Face: major source
Hugging Face was the largest single source in the study, with 8,482 unique exposed AWS keys. Of those keys, 17.9 percent were root keys.
Truffle Security previously analyzed 7.6 petabytes of public AI training data on the platform. That analysis revealed 3,343 still-active AWS keys. More than 900 of them could access S3 buckets containing at least 51.7 TB of non-public data.
The problem is that a leaked key can end up in multiple places. For example, credentials from source code can be copied to Git history, container images, and datasets. Removing the original publication therefore does not make such a key secure again.
Truffle Security links the research findings to the introduction of AWS Analyze for TruffleHog. Among other things, this feature maps the associated user or role and the available permissions for any credentials found. This allows security teams to more quickly determine which leaked keys pose the greatest risks.
Truffle Security states that during the investigation, it only viewed read-only metadata and alerted the identifiable owners of exposed credentials.