Hundreds of Leaked AWS Admin Keys Remain Active, Posing Severe Cloud Account Takeover Risk

A recent investigation by Truffle Security has brought to light a critical and long-standing vulnerability within the AWS ecosystem: hundreds of publicly exposed access keys, many with full administrative privileges, remain active and exploitable. The research, which analyzed AWS credentials exposed between August 2022 and August 2026, re-validated over 10,000 key pairs on August 10, 2026, finding a staggering 88% were still authenticating successfully. Of particular concern are the 768 keys linked to corporate accounts that retain full administrator capabilities, comprising 526 root access keys and 242 IAM user keys with the `AdministratorAccess` managed policy. These credentials were discovered across various public repositories, including Git histories, Hugging Face datasets, Docker images, and CI/CD logs. This situation is profoundly significant for any organization leveraging AWS. An active root access key grants an attacker effective ownership of an AWS account, bypassing IAM permissions and allowing them to create new users, alter security controls, exfiltrate or destroy data, deploy resources, modify billing configurations, and even close the account entirely. Similarly, IAM keys with `AdministratorAccess` provide broad control over an organization's AWS resources. The prolonged activity of these leaked keys, some reportedly over five years old with a median age of 1,831 days, highlights a severe lapse in security practices. The financial implications are also stark, with some active leaked keys reportedly racking up over $420,000 in AWS spending in July alone. This persistent problem of exposed cloud credentials is not new but continues to be a major challenge in cloud security. The accidental exposure of API keys, tokens, and other secrets in public repositories or build artifacts is a well-established attack vector. While AWS does implement measures like the `AWSCompromisedKeyQuarantine` policy for identified compromised keys, the research indicates that these are often insufficient if organizations fail to actively rotate or revoke the exposed credentials. The median age of the leaked keys suggests a systemic failure in credential lifecycle management, where keys are created, used, and then forgotten, rather than being regularly rotated or immediately revoked upon exposure. The proliferation of AI platforms like Hugging Face, which emerged as the largest source of leaked keys, further complicates the landscape by providing new avenues for accidental exposure. In practice, this report serves as a critical wake-up call for all AWS users. Practitioners must immediately audit their AWS environments for exposed credentials. This includes implementing robust secret scanning tools in CI/CD pipelines and code repositories to detect and prevent leaks proactively. All root access keys should be deleted and replaced with IAM roles for administrative tasks, adhering to the principle of least privilege. For any identified leaked keys, immediate rotation and revocation are paramount. Furthermore, enforcing strict credential rotation policies and leveraging AWS services like IAM Access Analyzer to identify unintended access are crucial. Finally, configuring budget alerts is a vital compensatory control, as it can provide an early warning system for unauthorized resource consumption resulting from compromised credentials. The onus is on organizations to treat any publicly exposed credential as compromised and act decisively to mitigate the risk.