The Ongoing Threat of Leaked AWS Keys: A Security Wake-Up Call
Recent revelations from security researchers have uncovered a troubling trend involving leaked Amazon Web Services (AWS) keys. A staggering over 9,300 leaked keys, which came to light between August 2022 and August 2026, have been confirmed as still active. Alarmingly, among these, hundreds possess full administrative privileges.
The research conducted by Truffle Security highlights a systemic failure across various platforms wherein AWS keys have been carelessly exposed. Their analysis revealed an alarming total of 64,024 unique AWS key pairs identified within a massive data set of 431,875 public findings. These findings were sourced from several platforms, including git history, Hugging Face datasets, Docker images, package registries, and CI logs. This extensive scan underlines the precarious state of cybersecurity surrounding cloud services.
Truffle Security verified 10,616 pairs of these keys that contained complete credential sets, taking an additional step to enumerate the capabilities embedded within these keys. This analysis provided insights into vital aspects like key age, attached policies, budgets, and even last month’s spending. They made it clear that no sensitive key material has been made public, and every identifiable key owner is being individually notified of the potential threat.
Of particular concern is that a significant 88% of the 10,616 verified key pairs are still capable of authenticating. Alarmingly, this group includes 768 corporate AWS keys, all with full administrative rights. Such access poses an immediate risk as it could facilitate unauthorized actions such as the theft or deletion of essential cloud data, or even the covert installation of cryptocurrency mining software to exploit the compromised access.
In terms of preventive measures, the report indicated that a mere 9.5% of these keys were equipped with budget alerts. These alerts are crucial in flagging suspicious activity, which could prevent potential catastrophes stemming from unauthorized usage.
Notably, Hugging Face, known for its community-driven database of machine learning datasets, emerged as the single largest source of the leaked keys. Researchers discovered a striking 8,482 unique live keys across 3,394 public datasets. Alarmingly, about 18% of these keys carried root privileges, giving them even more potential for misuse. The researchers further noted that among the keys with defined creation dates, the median age was around five years, while the oldest key identified was over 17 years old—a clear indication of neglect in key management practices.
The report further identified a concerning trend in key rotation practices. It noted, “Rotation is the rarer event.” Among the investigated keys, only 13.7% had any newer key alongside the leaked one, suggesting that the overwhelming majority—86%—had never undergone a rotation, been superseded, or properly cleaned up. This lack of proactive key management creates an ongoing vulnerability that could be exploited for malicious purposes.
Recommended Strategies for Mitigating Key Leak Risks
In light of these unsettling findings, Truffle Security has urged organizations and individuals to reconsider their key management strategies to reduce the security risks associated with leaked AWS keys. Their recommendations include:
-
Eliminate Root Access Keys: Organizations should meticulously delete root access keys, checking all user accounts, including personal ones, as nearly one in six leaked keys had root privileges.
-
Sort IAM Keys by Age: Users can employ the “aws iam list-access-keys” command to sort IAM keys by their creation age and enforce a maximum age policy for keys.
-
Implement Budget Alerts: Setting up budget alerts—even a minimal $10 threshold—can facilitate early detection of suspicious activities, particularly in accounts where 90.5% lacked any alerts.
-
Treat Exposed Secrets as Permanently Compromised: The researchers found that 43% of discovered keys reappeared across multiple repositories, datasets, and images, suggesting they should be regarded as compromised indefinitely.
- Monitor for Compromise Notifications: If AWS issues the “AWSCompromisedKeyQuarantine” status to a user, it signals that the key is publicly exposed, which warrants immediate action.
The stark reality painted by these findings serves as a wake-up call for many organizations utilizing AWS. As dependency on cloud-services increases, so does the critical need for robust security practices surrounding key management. The implications of compromised AWS keys do not just pose risks at individual organizational levels; they can potentially reverberate across entire industries. Therefore, vigilant monitoring, proactive key management, and swift action must become standard practices to safeguard against the repercussions of leaked keys.