Active AWS Keys Expose Corporate Accounts to Full Control Risks

Over 9,300 AWS access keys, publicly exposed from August 2022 to August 2026, remain active. Truffle Security identified 768 keys linked to companies, including 526 root keys and 242 IAM users with AdministratorAccess. The keys were found across various platforms, including Git repositories and datasets. Of the 10,616 keys verified, 88% still authenticate, with the median age being five years. The oldest key is 17.4 years old, and only 13.7% of the keys had been rotated. This situation poses significant risks, allowing potential attackers to access, exfiltrate, or wipe cloud-hosted data. Truffle Security has notified all identifiable owners of the exposed credentials. Recommendations include deleting root access keys and rotating exposed keys.

Key Points: • 768 active AWS keys provide full control over corporate accounts. • 88% of verified keys are still active, with a median age of five years. • Only 13.7% of the compromised keys have been rotated, increasing risk.