Unrestricted Access: Thousands of Exposed AWS Credentials Grant Attackers Full Corporate Cloud Control

A comprehensive analysis has revealed a staggering number of Amazon Web Services (AWS) access keys, numbering in the thousands, remain publicly exposed and actively functional, presenting a critical vulnerability that could grant unauthorized actors complete administrative control over corporate cloud infrastructure and sensitive data. This persistent exposure, spanning several years, underscores a significant and ongoing security lapse within numerous organizations leveraging AWS for their critical operations, ranging from hosting applications and storing vast datasets to managing complex IT environments.

Recent findings by cybersecurity researchers indicate that over 9,300 AWS access keys, initially exposed between August 2022 and August 2026, continue to be valid and active. This alarming persistence highlights a profound challenge in credential hygiene and incident response within the cloud computing landscape. The research, which has systematically tracked these exposures for an extended period, points to a widespread issue where fundamental security practices are either overlooked or inadequately implemented, leaving digital assets vulnerable to exploitation.

Among the identified active keys, a substantial portion—817—were directly linked to corporate entities, representing a direct threat to enterprise-level cloud deployments. More critically, 526 of these exposed credentials were identified as AWS root keys. Root keys represent the highest level of privilege within an AWS account, possessing unrestricted access to all resources and services without the constraints of Identity and Access Management (IAM) policies. This makes their exposure particularly devastating, as a compromised root key effectively translates to an attacker gaining complete dominion over an organization’s entire cloud footprint. Further compounding the risk, 242 of the keys were associated with IAM users provisioned with the highly permissive AdministratorAccess policy, which grants broad permissions across virtually all AWS services and resources. Such comprehensive access enables malicious actors to create, modify, delete, and view an extensive array of cloud components, rendering an organization’s digital operations entirely compromised.

The researchers unequivocally state that a significant number of these live keys—specifically 768 from the two identified high-risk categories—provide unfettered control over a company’s AWS account. This level of access is not merely theoretical; it empowers attackers with the capacity for severe and multifaceted forms of abuse. The implications extend far beyond simple data breaches, encompassing potential for widespread operational disruption, data manipulation, and the establishment of persistent backdoors within corporate networks.

The extensive scope of the problem was revealed through a meticulous scanning process across a vast digital terrain. The cybersecurity firm’s methodology involved sifting through an immense volume of digital artifacts, including code repositories, Git commit histories, public datasets, Docker images, container registries, and continuous integration (CI) logs. This exhaustive search uncovered an astonishing 431,875 AWS secrets. After a rigorous deduplication process, 64,024 unique AWS keys were extracted, corresponding to 50,654 distinct AWS accounts. While this initial discovery was substantial, the subset of credentials for which the researchers possessed complete authentication details—allowing for re-verification—totaled 10,616 keys. A staggering 88% of these re-verified keys remained active and functional as of the last validation on August 10, confirming the enduring nature of this security vulnerability.

Amazon Web Services (AWS) serves as the preeminent cloud-computing platform globally, providing an expansive suite of services essential for modern enterprises. Companies leverage AWS for a myriad of critical functions, including hosting websites and complex applications, secure data storage, running high-performance databases and virtual servers, managing domain infrastructure, and operating their entire online presence. Given this foundational role, the compromise of AWS credentials represents a catastrophic event for any organization.

The potential ramifications of gaining full control over a company’s AWS account are dire and multifaceted. An attacker armed with such credentials could:

• Exfiltrate or Wipe Data: Access and steal sensitive corporate data, customer information, intellectual property, and financial records, or maliciously delete critical datasets, leading to irrecoverable loss and significant operational downtime.
• Take Control of Servers and Applications: Hijack running applications, deploy malicious code, alter configurations, or completely shut down vital services, causing widespread business disruption.
• Create Rogue Admin Accounts: Establish new, unauthorized administrative users or modify existing ones to ensure persistent access, making detection and remediation efforts significantly more challenging.
• Deploy Cryptominers: Utilize the compromised cloud infrastructure to run resource-intensive cryptocurrency mining operations, resulting in exorbitant and unexpected billing charges for the victimized organization.
• Launch Further Attacks: Leverage the compromised environment as a launchpad for attacks against other internal systems or external targets, potentially implicating the victimized company in illegal activities.

A particularly concerning finding highlighted the lack of basic financial oversight in many compromised accounts. Out of 2,754 readable accounts, only 262 had budget alerts configured. This deficiency means that organizations would likely remain unaware of unusual expenditure spikes—such as those caused by unauthorized cryptomining—until potentially massive bills accumulate, significantly exacerbating the financial damage.

A major contributor to the leaked keys was identified as a popular online platform widely utilized by developers for sharing AI models, datasets, and applications. This platform alone accounted for an astounding 8,482 unique key exposures. Alarmingly, 17.9% of these keys were root credentials, possessing the highest level of unrestricted access. The nature of such collaborative platforms, which often involve developers sharing code and configuration files, inadvertently creates environments ripe for the accidental exposure of sensitive credentials.

Further analysis into the longevity of the exposed keys revealed deeply entrenched security issues. For the 2,903 keys with available creation dates, the median age was an astonishing 1,831 days, roughly equivalent to five years. The oldest key discovered had been active for an astounding 17.4 years. This prolonged existence without rotation significantly amplifies the risk of compromise. Moreover, only 398 (13.7%) of these entries showed a newer access key associated with the same user, strongly indicating a systemic failure in implementing regular key rotation policies. The vast majority of these long-lived keys had never been refreshed, leaving a persistent window of vulnerability open for years.

Root Causes and Systemic Failures

The prevalence and longevity of these exposed AWS keys point to several systemic failures in cloud security practices:

• Inadequate Secret Management: Developers often hardcode credentials directly into application code, configuration files, or commit them into version control systems (like Git). Without robust secret management solutions and automated scanning, these sensitive details inevitably find their way into public or insecure repositories.
• Lack of Least Privilege: The continued use of root access keys or overly permissive IAM policies (like AdministratorAccess) for routine operations violates the principle of least privilege. This practice grants users far more permissions than necessary, dramatically increasing the potential blast radius should those credentials be compromised.
• Poor Credential Hygiene: The lack of regular key rotation is a critical lapse. Even if a key is initially secured, its prolonged existence increases the window of opportunity for attackers to discover and exploit it. A robust rotation policy limits the effective lifetime of a compromised credential.
• Insufficient Monitoring and Alerting: The absence of budget alerts, as well as broader security monitoring for anomalous activity (e.g., access from unusual IP addresses, sudden spikes in resource usage, unauthorized API calls), means that breaches often go undetected for extended periods.
• Developer Education Gaps: There is often a disconnect between developers’ focus on functionality and their understanding of cloud security implications. Comprehensive training on secure coding practices, secret management, and cloud security best practices is essential.

Mitigation Strategies and Best Practices

To effectively defend against such widespread credential abuse, organizations must adopt a multi-layered and proactive approach to cloud security:

• Eliminate Root Access Keys for Daily Operations: Root access keys should be treated with extreme caution. They should ideally be deleted after initial account setup, with MFA enabled, and stored securely for emergency use only. All operational activities should be performed using IAM users or roles with the principle of least privilege.
• Implement Robust IAM Policies: Enforce strict IAM policies that grant only the necessary permissions for specific tasks. Regularly review and audit IAM policies to identify and revoke any overly permissive access. Utilize IAM roles for applications and services instead of long-lived access keys.
• Automated Secret Management: Integrate dedicated secret management solutions (e.g., AWS Secrets Manager, HashiCorp Vault) into development and deployment pipelines. These tools securely store, rotate, and manage credentials, preventing them from being hardcoded or exposed.
• Automated Code Scanning: Deploy automated security tools (SAST, DAST) to scan code repositories, CI/CD pipelines, and other digital assets for exposed credentials, misconfigurations, and vulnerabilities before they reach production.
• Mandatory Key Rotation: Establish and enforce a strict policy for regular access key rotation for all IAM users and roles. Automated rotation mechanisms should be preferred wherever possible.
• Enhanced Monitoring and Alerting: Implement comprehensive logging through AWS CloudTrail, CloudWatch, and other security services. Configure detailed alerts for unusual activity, unauthorized access attempts, and abnormal cost spikes. Security Information and Event Management (SIEM) solutions can aggregate and analyze these logs for early threat detection.
• Multi-Factor Authentication (MFA): Mandate MFA for all AWS users, especially for root accounts and users with administrative privileges, adding an essential layer of security against compromised credentials.
• Security Awareness Training: Continuously educate developers, operations teams, and all cloud users on the critical importance of secure coding practices, proper credential handling, and the risks associated with public exposure.
• Treat Publicly Committed Credentials as Compromised: Any credential that has been committed to a public repository or inadvertently exposed should be immediately revoked and replaced. It should be assumed that such credentials have been accessed by malicious actors.

The Shared Responsibility Model

It is imperative to understand the AWS Shared Responsibility Model. AWS is responsible for the security of the cloud, meaning the underlying infrastructure, physical security, and global network. Customers, however, are responsible for security in the cloud. This includes the configuration of their AWS environment, data management, network access controls, and, critically, the management of their identities and access keys. AWS provides a wealth of security tools and services, but their effective implementation and ongoing management fall squarely on the customer. When AWS becomes aware of exposed keys, it typically notifies affected customers and may apply quarantine policies to mitigate risk. However, the onus remains on the customer to respond promptly and implement preventative measures.

Future Outlook

The persistent issue of leaked cloud credentials underscores the evolving nature of cybersecurity threats in an increasingly cloud-centric world. As cloud environments become more complex and interconnected, the attack surface expands, making robust credential management and proactive security monitoring more critical than ever. The continuous cat-and-mouse game between attackers seeking vulnerabilities and defenders striving for resilience necessitates a dynamic and adaptive security posture. Organizations must move beyond reactive measures, embracing a culture of security-by-design, where robust security practices are embedded throughout the entire software development lifecycle and operational framework. Regulatory pressures, data privacy concerns, and the ever-present threat of significant financial and reputational damage will continue to drive the need for organizations to prioritize and invest in comprehensive cloud security strategies, ensuring that their digital assets remain protected from unauthorized access.

The sheer volume of active, exposed AWS keys granting full administrative control represents a profound and ongoing risk to global enterprises. This critical vulnerability demands immediate attention, comprehensive audits, and a fundamental shift towards more mature and proactive cloud security practices. Organizations must recognize that securing their cloud infrastructure is not merely a technical task but a continuous strategic imperative vital for business continuity and data integrity in the digital age.