A staggering number of Amazon Web Services (AWS) access keys have been left exposed online, putting hundreds of companies at risk of full control over their corporate accounts. Truffle Security has been tracking this issue for four years and has found that over 9,300 AWS access keys have been publicly exposed since August 2022.
These exposed keys are still active and valid, giving attackers the ability to gain full control over a company’s AWS account. In fact, researchers have identified 817 of these exposed keys as linked to companies, with 526 being root keys that hold the highest level of access within an account. This is particularly alarming, as each of these exposed keys can grant an attacker full control over a company’s AWS account.
But how does this work? Essentially, when you create an AWS account, you’re given an access key – a unique string of characters that allows you to manage your account and its resources. These keys are meant to be kept secure, but in many cases, they’ve been left exposed online through various means such as code repositories, Git history, datasets, Docker images, registries, and CI logs.
Truffle Security has found that the majority of these exposed keys were linked to Hugging Face, a popular online platform for developers to share AI models, datasets, and applications. A staggering 8,482 unique key exposures were linked to this platform alone, with 17.9% being root keys – the highest-privileged identity in an account.
But what’s perhaps most concerning is that many of these exposed keys have been around for a long time. Researchers found that the median age of these exposed keys was over five years, while some had existed for as long as 17.4 years. This suggests that companies have not been regularly rotating or revoking their access keys – a crucial security practice that helps prevent exactly this kind of situation.
So what does this mean for companies? In short, it means that attackers could gain full control over their AWS account, allowing them to access, exfiltrate, or wipe cloud-hosted data, take control of servers and applications, and create rogue admin accounts for persistent access. Threat actors could also use their access to deploy cryptominers, generating substantial charges for the company.
To defend against potential abuse, Truffle Security recommends deleting all root access keys, reviewing IAM credentials by age, rotating or revoking exposed keys, and configuring budget alerts. It’s also essential that companies treat any credential committed to a public source as compromised – in other words, assume it’s been seen by attackers.
Ultimately, this is a stark reminder of the importance of maintaining good security hygiene – keeping access keys secure, regularly rotating them, and monitoring for potential threats. By taking these simple steps, companies can reduce their risk of being compromised and protect their sensitive data and resources.
Source: Bleeping Computer — 2026-08-21