Cybersecurity firm **Truffle Security** has been diligently tracking the public exposure of **AWS** access keys for the past four years. Their latest findings indicate a staggering number of active, valid keys that could grant attackers complete control over corporate cloud infrastructure. ### The Scale of the Exposure Out of the more than 9,300 publicly exposed **AWS** access keys identified, **Truffle Security** confirmed that 817 were linked to companies. Alarmingly, 526 of these were **AWS** root keys – the highest privilege level, unrestricted by **IAM** permissions. An additional 242 keys were associated with **Identity and Access Management (IAM)** users holding the `AdministratorAccess` policy, which grants full permissions across virtually all **AWS** services and resources.  In total, **Truffle Security** identified 431,875 **AWS** secrets across various repositories, including code repositories, Git history, datasets, Docker images, and CI logs. From these, 64,024 unique **AWS** keys corresponding to 50,654 **AWS** accounts were extracted. A subset of 10,616 keys, for which complete credentials were available for re-verification, showed an alarming 88% remained authenticating as of August 10.  **Unique verified exposed AWS keys** *Source: Truffle Security* ### The Grave Implications of Compromised Keys Full control over a company's **AWS** account presents a catastrophic risk. Threat actors could leverage such access to: * Access, exfiltrate, or wipe cloud-hosted data. * Take control of servers and applications. * Create rogue administrator accounts for persistent access. * Deploy cryptominers, leading to substantial and unexpected charges for the victimized company. **Truffle Security** highlighted a critical oversight: only 262 of 2,754 readable accounts had a budget alert configured, leaving many companies vulnerable to financial exploitation without immediate notice. ### **Hugging Face** as a Major Source **Hugging Face**, a popular platform for sharing AI models and datasets, emerged as the single largest source of leaked **AWS** keys, accounting for 8,482 unique exposures. Of these, 17.9% were root keys, underscoring the severity of this particular exposure vector.  **Roles of exposed AWS keys** *Source: Truffle Security* ### The Problem of Stale and Unrotated Keys Analysis of 2,903 keys with available creation dates revealed a median age of 1,831 days (approximately five years), with the oldest key existing for 17.4 years. Disturbingly, only 398 (13.7%) of these entries had a newer access key associated with the same user, indicating that the vast majority had never been rotated.  **Age of exposed AWS keys** *Source: Truffle Security* ### Recommendations for Defense To mitigate the significant risks posed by leaked **AWS** credentials, **Truffle Security** provides several crucial recommendations for IT security professionals: * **Delete all root access keys**: Root keys should be avoided for daily operations. * **Review IAM credentials by age**: Identify and prioritize older keys for rotation. * **Rotate or revoke exposed keys**: Immediately invalidate any credentials found in public sources. * **Configure budget alerts**: Implement alerts to detect unusual spending patterns that might indicate cryptomining or other malicious activity. * **Treat public commits as compromised**: Any credential committed to a public source, regardless of intent, should be considered compromised and immediately rotated. **Truffle Security** emphasized that their testing was limited to read-only metadata, and they have taken steps to notify all identifiable owners of the exposed credentials.