Over 9,300 Amazon Web Services (AWS) access keys, publicly exposed between August 2022 and August 2026, remain active and valid, according to research from Truffle Security. The firm has been tracking these exposures for four years, identifying 817 keys linked to companies, with 526 of these being AWS root keys.
Among the exposed keys, 242 are associated with Identity and Access Management (IAM) users holding the AdministratorAccess policy. This policy grants full permissions across virtually all AWS services and resources within an account, allowing for creation, modification, deletion, and viewing. Truffle Security confirmed that 768 live keys, across the two sets, provide full control over a company's AWS account.
The researchers initially discovered 431,875 AWS secrets across various sources, including code repositories, Git history, datasets, Docker images, registries, and CI logs. From these, 64,024 unique AWS keys were extracted, corresponding to 50,654 AWS accounts after duplicate removal. A subset of 10,616 keys, for which complete credentials were available for re-verification, showed that 88% remained authenticating as of August 10.
Full control of an AWS account could enable attackers to exfiltrate or wipe cloud-hosted data, seize control of servers and applications, and establish persistent access through rogue administrator accounts. Threat actors could also exploit this access to deploy cryptominers, incurring substantial charges for the affected companies. Truffle Security noted that only 262 of 2,754 readable accounts had budget alerts configured.
Hugging Face, a platform for sharing AI models, datasets, and applications, was identified as the largest single source of leaked AWS keys, accounting for 8,482 unique key exposures. Of these, 17.9% were root keys, representing the highest-privileged identity with no IAM permission restrictions.
Analysis of 2,903 keys with available creation dates revealed a median age of 1,831 days, approximately five years, with the oldest key having existed for 17.4 years. Only 398 (13.7%) of these entries had a newer access key associated with the same user, indicating that most had not been rotated.
Truffle Security's testing was limited to read-only metadata, and the firm stated it has notified all identifiable owners of the exposed credentials. The researchers recommend several defensive measures, including deleting all root access keys, reviewing IAM credentials by age, rotating or revoking exposed keys, and configuring budget alerts. They also advise treating any credential committed to a public source as compromised.
