Thousands of Corporate AWS Keys Remain Exposed, Granting Full Admin Access
A recent investigation found 768 corporate AWS keys publicly exposed and still active, providing full administrator access and posing significant security risks.
A new cloud security investigation by Truffle Security has revealed a persistent and alarming issue: 768 corporate AWS credentials remain publicly exposed and actively grant full administrative control over sensitive AWS environments. These credentials, discovered across various public sources including Git repositories, Hugging Face datasets, and CI/CD logs between August 2022 and August 2026, highlight critical failures in credential management, secret rotation, and cloud account monitoring.
The investigation re-verified over 10,000 leaked AWS credential pairs, finding that approximately 88% still authenticated successfully. Among the active corporate-linked credentials, a staggering 526 were AWS root access keys, and 242 belonged to IAM users with the highly privileged AdministratorAccess policy. Both types of credentials can effectively grant complete control over an AWS account, with root keys being particularly dangerous due to their ability to bypass IAM policies and perform critical account-level actions.
Truffle Security's analysis uncovered a total of 64,024 unique AWS key pairs within 431,875 public findings, including over 10,000 root credentials. The median age of a leaked key was found to be five years, with the oldest dating back an astonishing 17.4 years. This longevity is attributed to a severe lack of credential rotation; among keys that allowed for access-key enumeration, only 13.7% had a newer replacement key available, indicating that most exposed credentials were never revoked or removed after becoming public.
The problem of exposure is exacerbated by the fact that leaked keys do not become safe simply because the original file is deleted. Public repositories can be cloned, archived, and indexed, with credentials frequently being copied into container images or included in machine-learning datasets. The research found that 43% of exposed keys appeared in multiple locations, allowing the exposure to spread far beyond the initial commit. Hugging Face was identified as a particularly significant source, hosting 8,482 unique active keys across thousands of public datasets, with nearly 18% of those being root credentials.
This widespread redistribution through downstream datasets and projects creates a long-term exposure risk, where keys accidentally committed years prior can resurface even after being removed from their original source. Compounding these credential management issues, the investigation also highlighted weak cloud cost monitoring practices. Of the accounts where budget information was accessible, only 9.5% had any budget alerts configured, with a median configured budget of just $8. This lack of oversight means that compromised accounts could be used for illicit activities like cryptomining or data theft without immediate detection.
To mitigate these risks, organizations are strongly advised to immediately remove all root access keys, rotate any exposed IAM keys, and enforce strict maximum key age policies. A proactive approach to security involves scanning not just current source code but also Git history, container images, CI logs, and public datasets. Best practices also include utilizing least-privilege IAM roles instead of long-lived access keys for production workloads and configuring robust budget alerts.
The findings coincide with the launch of TruffleHog AWS Analyze, a new capability designed to help organizations identify the potential access and impact of exposed AWS credentials. This tool aims to provide deeper visibility into attached policies, groups, roles, and trust relationships, enabling faster incident response and prevention.