Hundreds of leaked AWS keys give full control over corporate accounts

If you've ever pasted an AWS access key into a shell script, a `.env` file, or a debug commit "just to get the deploy working," you're not alone — and that's exactly the problem. A new sweep of public code repositories, container images, and CI logs found more than 9,300 live AWS keys sitting in plain sight, some of them years old, all of them still working.

For a small SaaS company, this isn't an abstract cloud-security statistic. AWS is the company — the database, the file storage, the servers running the product. A single leaked key with the wrong permissions doesn't mean an attacker reads a file. It means they own the account.

What actually happened

Security firm Truffle Security scanned public repositories, Docker images, and CI logs between August 2022 and August 2026 and turned up 431,875 exposed AWS secrets. After deduplication, that came out to 64,024 unique keys spread across 50,654 AWS accounts. Of the keys the researchers could tie to a specific company — 817 of them — 526 were root keys, the ones with no permission ceiling at all, and 242 carried full AdministratorAccess. As of August 10, 88% of the 10,616 keys they were able to verify were still active.

Hugging Face turned out to be the single largest source of exposures: 8,482 unique keys, nearly 18% of them root. The keys skew old — a median age of 1,831 days, roughly five years, with the oldest still valid after 17.4 years. Only 398 of them, 13.7%, had ever been rotated. And of the accounts the researchers could read into, only 262 out of 2,754 had budget alerts turned on — meaning most companies with a live, exposed key would have no automated way to notice someone else spending their AWS bill.

"Full control of a company's AWS account could allow an attacker to access, exfiltrate, or wipe cloud-hosted data, take control of servers and applications, and create rogue admin accounts for persistent access."
— BleepingComputer

AWS's response was that it notifies affected customers and applies quarantine policies once it's made aware of an exposure — which is true, but it depends on someone finding the leak first. The researchers found most of these using nothing more exotic than public search across repositories anyone can already browse.

A familiar scenario

Picture a 15-person SaaS company in its second year. A backend engineer is wiring up a deploy script in 2023 and hardcodes the AWS root key directly into it to get past a permissions error — "just for now." The script gets committed to a repo that's public for exactly the kind of reason small teams end up with public repos: an open-source utility, a demo, a fork that was never cleaned up. Nobody remembers the key is there. Nobody rotates it. There's no budget alert, because nobody set one up on day one and it never became a priority. Three years later, that key is still root, still valid, and sitting in a place anyone running the same kind of scan Truffle Security ran could find in seconds. The company finds out not from a dashboard, but from a bill.

What to actually do about it

• Delete root access keys entirely. A root key should not exist as a long-lived credential in the first place — use IAM users or roles for everything that isn't one-time account setup.
• Rotate anything old or exposed. If a key is more than 90 days old, or has ever touched a public repo, a Docker image, or a CI log, rotate it and treat the old one as compromised — don't wait for proof it was used.
• Turn on AWS budget alerts today. It takes minutes and is the fastest way to notice someone else is spending on your account before the bill does.
• Move off static keys where you can. IAM roles and OIDC federation for CI/CD mean there's no long-lived secret sitting in a script or a log to leak in the first place.
• Search your own history before someone else does. Grep your repos, commit history, and CI logs for anything that looks like an access key pattern — this is exactly what turned up 9,300 of them elsewhere.

Leaked credentials are one piece of a much bigger blind spot most small SaaS companies have about what's actually visible to the outside world. OrangeStealth's External Security Posture Assessment looks at your company from the outside, the same vantage point an attacker starts from, and tells you plainly where the exposure is before it turns into a bill you didn't expect.