Leaked Corporate AWS Keys Expose Full Admin Rights
Security researchers found over 64,000 live Amazon Web Services access keys sitting exposed in public code, AI datasets, and container images. Many of those keys hand out full admin control over a company's cloud account, letting anyone who finds them run up huge bills or take over the infrastructure.
- Report priority
- Medium
- Involves
- Docker
What is known
Developers accidentally committed live AWS access keys into public GitHub code, Hugging Face AI training datasets, Docker container images, and CI logs, and researchers scanned those public sources to find over 64,000 keys that still worked.
What to do
Search your own public GitHub repositories, Hugging Face datasets, Docker images, package registries, and CI/CD logs for any AWS access keys, especially root account keys, and check the AWS console for a quarantine policy tag, which means AWS already flagged one of your keys as publicly leaked.
There is no software patch for this since it is a credential-hygiene problem: delete every root access key immediately, rotate any IAM user key that has not been changed on a regular schedule, and turn on AWS billing alerts so unauthorized spending gets caught fast, per Truffle Security's report.
Reported details
A global IT consulting firm accidentally leaked 19 separate AWS keys spread across its independent enterprise cloud accounts. Researchers found the keys were still active, some dating back years, and some belonging to root accounts with unrestricted control over everything in the account. Because only about one in ten of the exposed accounts had billing alerts turned, someone using a key like this could run up cloud charges or dig through cloud resources without the owner noticing right away.
Truffle Security scanned public GitHub commits, Docker container images, package registries, CI logs, and Hugging Face datasets, and verified 64,024 live AWS access key pairs across 431,875 findings, spanning 9,945 distinct AWS accounts. Of these, 10,625 were root account keys, which cannot be permission-scoped down and grant unrestricted control. Among the 7,590 active IAM user keys researchers could inspect permissions for, 84 percent carried full admin rights, and 130 leaked root keys controlled entire AWS Organizations management accounts. The median live leaked key was 1,831 days old, 86 percent were never rotated or revoked, and only 9.5 percent of exposed accounts had billing alerts configured.