Security researchers have claimed that over 9300 leaked AWS keys which surfaced between August 2022 and August 2026 are still active, including hundreds with full admin rights.

Truffle Security said its scanners found 64,024 unique AWS key pairs across 431,875 public findings: git history, Hugging Face datasets, Docker images, package registries and CI logs.

“We took the 10,616 pairs with complete credentials and re-verified them, then enumerated what each key can tell us about its account: key age, attached policies, budgets, and last month's spend,” the security vendor continued.

“No key material is published, and every owner we could identify is being notified.”

Of the 10,616 pairs, 88% still authenticate. They include 768 corporate AWS keys which have full admin rights, Truffle Security said.

Read more on AWS keys: CISA Details Incident Response to Exposed AWS GovCloud Keys

AWS account takeover could allow malicious actors to steal or delete critical cloud data, or even covertly install cryptocurrency mining software to monetize access that way.

Only 9.5% of keys had a budget alert set up which would flag this kind of activity, the report claimed.

Hugging Face was the largest single source of leaked keys, with 8482 unique live keys discovered across 3394 public datasets – 18% of which had root privileges.

For live keys with creation dates, the median age was around five years, although the oldest was over 17 years.

“Rotation is the rarer event,” the report continued. “Of the keys where we could enumerate the user's access keys, only 13.7% (398 of 2903) have any newer key alongside the leaked one. The other 86% were never rotated, superseded, or cleaned up.”

Steps to Reduce the Risk of Leaked AWS Keys

Truffle Security urged organizations and individuals to improve key handling in order to minimize security risk, sharing the following advice:

• Delete root access keys, checking every account, including personal ones. The report claimed one in six leaked keys had root privileges
• Sort IAM keys by age using “aws iam list-access-keys” plus a maximum age policy
• Set a budget alarm to catch crypto-mining early. Even a $10 alert would be better than nothing, given that 90.5% of leaked-key accounts have no alert set up
• Treat exposed secrets as permanently compromised: 43% of those discovered by the researchers appeared more than once across repos, datasets, and images
• Watch for the quarantine policy: If AWS attaches “AWSCompromisedKeyQuarantine” to a user, it is saying that the key is public

An AWS spokesperson sent the following statement to Infosecurity:

"Anytime AWS is aware of exposed keys, we notify the affected customers. We also thoroughly investigate all reports of exposed keys and quickly take any necessary actions, such as applying quarantine policies to minimize risks for customers without disrupting their IT environment. AWS helps customers secure their cloud resources through a shared responsibility model. We encourage all customers to follow security, identity, and compliance best practices. In the event a customer suspects they may have exposed their credentials, they can start by following the steps listed in this post. As always, customers can contact AWS Support with any questions or concerns about the security of their account."