A large-scale investigation has uncovered 768 publicly exposed AWS access keys that remain active and grant full administrative privileges to corporate cloud environments, posing a serious risk of account takeover, data theft, infrastructure abuse, and cloud billing fraud.
The credentials include 526 root access keys and 242 IAM user keys attached to AWS’s AdministratorAccess managed policy.
In the hands of an attacker, either type of credential could enable broad control over an organization’s AWS resources, including identity management, storage, compute instances, security configurations, billing settings, and potentially entire accounts.
768 Leaked AWS Keys Still Active
Documented by Truffle Security, which analyzed publicly exposed AWS credentials between August 2022 and August 2026. Researchers re-validated 10,616 key pairs on August 10 and found that 88% still authenticated successfully.
The exposed keys were discovered across publicly accessible Git histories, Hugging Face datasets, Docker images, package registries, and CI/CD logs.
While the research does not disclose the identities or values of affected accounts, the number of still-valid secrets indicates that publicly leaked cloud credentials frequently remain usable for years.
Across the entire dataset, Truffle Security identified 64,024 unique AWS access key pairs from 431,875 publicly reported findings. Of those, 10,625 or 16.6% were root credentials.
Root access keys are among the most critical AWS security risks because they are not subject to IAM permissions. A valid root key gives an attacker effective ownership of the AWS account, allowing them to create new users, alter security controls, read or destroy data, deploy resources, modify billing configurations, and even close the account.
Hugging Face emerged as the largest individual source of exposed AWS credentials. Researchers found 8,482 unique live keys across 3,394 public datasets, with root keys accounting for 17.9% of the total.
Many of those datasets appear to contain public code collected for AI training and development. That creates a long-term secrets-management problem.
A key accidentally committed to a public repository can be copied into training datasets, container images, package archives, models, forks, and derivative repositories. Removing the original file does not eliminate the leaked secret from the wider internet ecosystem.
The investigation also found that many live credentials were exceptionally old. For 2,903 keys where creation dates could be determined, the median age of an active leaked key was 1,831 days, roughly five years. The oldest exposed credential was 17.4 years old.
Only 25 enumerable keys had been created during the prior 30 days, indicating that the greatest risk comes from forgotten credentials rather than solely from newly introduced developer mistakes.
Rotation practices were also poor: just 398 of the 2,903 keys had a newer credential linked to the same IAM user, suggesting about 86% had never been replaced or revoked.
AWS had already flagged 929 active IAM keys with its AWSCompromisedKeyQuarantine policy, yet they remained present in affected environments.
Of 817 active keys linked to business accounts, 768 retained full administrator capabilities. Researchers also identified 130 live root keys tied to AWS Organizations management accounts, potentially placing connected member accounts at risk.
Organizations should eliminate root access keys, enforce key-age limits, rotate exposed credentials immediately, monitor for unauthorized activity, and configure budget alerts. Any secret exposed publicly should be treated as permanently compromised.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
