Hundreds of Leaked AWS Keys Expose Corporate Cloud Accounts

Scope of the Leak

Security researchers identified more than 9,300 Amazon Web Services (AWS) access keys that were publicly visible on code repositories, forums and misconfigured servers. The data set spans a four‑year period from August 2022 to August 2026. Roughly half of the keys remain active, meaning they can still be used to authenticate to AWS services.

How the Keys Were Discovered

The investigation relied on automated scanning tools that crawl public Git platforms, cloud storage buckets and paste sites. When a key pattern matches the format used by AWS, the scanner records the find and attempts a harmless validation request to confirm whether the key is still valid. This method revealed a steady stream of new exposures each month.

Key discovery efforts are supported by reports from the AWS security blog and alerts from the United States Computer Emergency Readiness Team (CISA), both of which advise developers to rotate credentials regularly.

Risks of Unrestricted Access

An active AWS access key can be used to perform any action that the associated IAM (Identity and Access Management) policy permits. In many of the leaked cases, policies granted broad permissions such as AdministratorAccess or full access to storage buckets, compute instances and database services.

• Data exfiltration – attackers can copy sensitive files from S3 buckets to their own locations.
• Resource hijacking – compute instances can be launched to run cryptocurrency miners or host malicious payloads.
• Service disruption – critical workloads can be terminated or re‑configured, leading to downtime.
• Financial impact – unauthorized usage can generate large cloud bills, sometimes reaching tens of thousands of dollars per day.

Real world incidents linked to exposed keys

Several high profile breaches have been traced back to leaked cloud credentials. In 2023, a ransomware group leveraged an exposed AWS key to encrypt backup data stored in a corporate S3 bucket, demanding a ransom of $2.5 million. The same year, a financial services firm experienced a $1.2 million bill after attackers used a stolen key to spin up hundreds of GPU instances for illicit crypto mining.

Mitigation Strategies for Organizations

Addressing the threat requires both immediate response and long term hygiene practices.

1. Immediate key revocation: Use the AWS console or CLI to deactivate any key that appears in public scans. Automated scripts can be scheduled to check for newly exposed keys on a daily basis.
2. Implement least privilege: Review IAM policies and ensure that each key only has the permissions required for its specific task. The NIST SP 800‑53 provides guidance on role based access control.
3. Enable multi‑factor authentication (MFA) for all privileged accounts. MFA adds an extra verification step that prevents attackers from using a stolen key alone.
4. Adopt secret management solutions: Tools such as AWS Secrets Manager or HashiCorp Vault store credentials securely and rotate them automatically.
5. Monitor usage patterns: Set up CloudTrail alerts for anomalous activities, such as API calls from unexpected IP ranges or spikes in resource creation.

Role of Cloud Providers and Industry Standards

AWS has introduced several features to reduce the impact of credential leaks. The IAM Access Analyzer can identify resources that are shared publicly or with external accounts. Additionally, AWS Config rules can enforce that access keys are not embedded in code repositories.

Industry bodies such as the Cloud Security Alliance publish the CSA Security Guidance, which recommends regular credential audits, automated scanning and strict secret handling policies.

Regulators in several jurisdictions are also tightening requirements around cloud security. The European Union’s Cybersecurity Act mandates that providers demonstrate robust key management practices.

Moving Forward

While the volume of leaked keys is alarming, the situation also highlights a clear path forward. Organizations that adopt automated scanning, enforce least privilege and leverage built‑in cloud security tools can dramatically reduce the attack surface. Continuous education for developers about the dangers of hard‑coding credentials remains essential.

By treating cloud keys as highly sensitive assets and applying the same rigor used for physical keys, companies can protect their data, reputation and bottom line from the growing threat of credential exposure.