Researchers Find Hundreds of Exposed AWS Keys Still Grant Administrative Access

What if a cloud credential leaked years ago could still unlock an entire company’s infrastructure today? Cybersecurity researchers have found that hundreds of exposed AWS keys continue to provide unrestricted access to corporate accounts.

Truffle Security researchers analyzed 10,616 exposed AWS key pairs that had been publicly exposed in repositories, datasets, Docker images, and other online sources. The researchers found that 88% of the Amazon Web Services (AWS) key pairs were still valid, and 768 keys provided complete administrative control over corporate AWS accounts. This includes 526 root account keys and 242 IAM user accounts with AdministratorAccess permissions.

According to the researchers, about one in six belonged to root accounts across the larger dataset of 64,024 verified AWS keys. Hackers could abuse this flaw to gain unrestricted access to entire AWS environments.

Poor credential management leaves AWS accounts exposed

This research found that the average active leaked AWS key was approximately five years old, which suggests that many organizations are not regularly reviewing, rotating, or removing outdated credentials. Moreover, over 86% of the exposed keys analyzed showed no signs of ever being replaced, which indicates a lack of credential management. Some leaked keys had remained active for over 17 years.

Overprivileged IAM accounts increase security risks

This analysis found that many exposed IAM user accounts had highly privileged access, which significantly increases the potential impact of a security breach. Interestingly, 84% of the IAM users were linked to the AWS-managed AdministratorAccess policy, while others possessed extensive IAM management permissions that could be used to modify users, roles, and access controls.

This study also identified various credentials that AWS had already flagged as compromised and restricted through its quarantine process. However, many of these keys remained active because their owners had not removed or rotated them.

Leaked AWS keys could give attackers broad access

Researchers identified hundreds of active keys connected to real companies. Some belonged to AWS organization management accounts, which can control multiple AWS accounts from a single location. Although many exposed accounts showed little spending activity, some were linked to environments with significant monthly cloud expenses.

Researchers urge organizations to strengthen AWS credential management

Organizations should take a more proactive approach to managing AWS credentials, starting with the elimination of root access keys wherever possible. The exposure of root credentials can lead to severe security consequences. Moreover, companies should regularly review and rotate IAM access keys, especially older credentials that may no longer be needed. It’s also recommended to establish policies that automatically flag or retire aging keys to reduce the risk of forgotten credentials remaining active for years.

The researchers also advise organizations to implement cloud cost and budget alerts, which can serve as an early warning system for unauthorized activity. Moreover, businesses should assume that any credential exposed in source code, datasets, repositories, or container images is permanently compromised and should be revoked immediately. AWS security notifications should be treated as urgent warnings that require immediate investigation and remediation to prevent attackers from exploiting exposed accounts.