A large-scale investigation by Truffle Security has uncovered 768 publicly exposed AWS access keys that remain active and grant full administrative privileges to corporate cloud environments, posing a serious risk of account takeover, data theft, and cloud billing fraud.
The credentials include 526 root access keys and 242 IAM user keys attached to Amazon Web Services’ AdministratorAccess managed policy. In the hands of an attacker, either type of credential could enable broad control over an organization’s AWS resources, including identity management, storage, compute instances, security configurations, billing settings, and potentially entire accounts.
88 Percent of Leaked Keys Still Work
Truffle Security analyzed publicly exposed AWS credentials between August 2022 and August 2026, re-validating 10,616 key pairs on August 10. Researchers found that 88 percent still authenticated successfully. The exposed keys were discovered across publicly accessible Git histories, Hugging Face datasets, Docker images, package registries, and CI/CD logs.
Across the entire dataset, Truffle Security identified 64,024 unique AWS access key pairs from 431,875 publicly reported findings. Of those, 10,625, or 16.6 percent, were root credentials. The largest single source was Hugging Face, where AWS credentials are the second most common secret type found, with 8,482 unique live keys across 3,394 public datasets. Hugging Face keys also skewed privileged, with 17.9 percent being root keys, the highest share of any source.
Median Leaked Key Is Five Years Old
For the 2,903 keys that permitted IAM enumeration, the median live leaked key was created 1,831 days ago. Half are over five years old, and the oldest is 17.4 years. Only 25 keys, less than 1 percent, were created in the last 30 days. Of the keys where researchers could enumerate the user’s access keys, only 13.7 percent had any newer key alongside the leaked one. The other 86 percent were never rotated, superseded, or cleaned up.
Separately, 929 of the 7,590 active IAM users carry Amazon’s own AWSCompromisedKeyQuarantine policy, meaning AWS had already detected those keys as exposed and restricted them. Yet 112 carry the original version that Amazon stopped applying in 2023, indicating those keys were flagged at least three years ago and their owners were notified by AWS. They still authenticate.
At the far end sit 130 live root keys on organization management accounts, the account that controls every member account in the org. One compromised management root exposes every account in the organization at once. The research also found that only 9.5 percent of accounts with readable budgets had any budget alert configured, leaving the vast majority of exposed accounts vulnerable to cryptomining or resource abuse with no financial early warning system.
Truffle Security is notifying every owner it could identify ahead of its publication. The researchers emphasized that deleting a leaked file does not help once the key has been absorbed into a machine learning training corpus, making key rotation the only reliable remediation.
discussion