9,300+ Exposed AWS Keys Found Still Active, Researchers Warn

What happened

According to BleepingComputer, researchers identified more than 9,300 AWS access keys that were publicly exposed between August 2022 and August 2026 and remain active and valid today. The keys were found leaked in public locations rather than obtained through a breach of AWS itself, and their continued validity means anyone who discovered them could still use them.

Why it matters for defenders

A valid, unrevoked AWS access key can grant an attacker the same permissions as the account it belongs to — in some cases full control over a corporate AWS environment, including data access, resource creation, and lateral movement across connected services. The multi-year exposure window reported here underscores that leaked credentials often go unnoticed and unrotated long after they are first published, giving attackers a persistent, low-noise entry point. Any organization that has ever committed a key to a public repository, pasted one into a public forum, or shipped one inside a public artifact is potentially affected.

What defenders should watch for or do now

• Audit AWS IAM access keys for age and last-used activity; rotate or disable any key that is old, unused, or of unknown provenance.
• Scan public and internal repositories, CI/CD logs, container images, and configuration files for hardcoded AWS credentials — including in commit history, not just current file contents.
• Enable and review AWS-native leaked-credential protections (e.g., AWS's own compromised-key quarantine notifications) and treat any such alert as high priority.
• Hunt in CloudTrail for API activity from IAM users/access keys that shows anomalous source IPs, unfamiliar user agents, or actions inconsistent with the key's normal usage pattern.
• Prefer short-lived credentials (IAM roles, STS tokens, OIDC federation) over long-lived static access keys wherever workloads allow it.
• Enforce least privilege on all IAM identities so that a single leaked key cannot translate into full account control.

Developing story

Details on exactly where these keys were exposed, which organizations are affected, and whether any have been abused are still emerging. This is net-new intelligence and not tied to a specific CVE or detection at this time — for the full report, see the original coverage at BleepingComputer.