Security researchers examining AWS credentials exposed between August 2022 and August 2026 re-tested 10,616 complete key pairs on August 10. Some 9,308, or about 88%, still authenticated successfully, pointing to a persistent failure by organisations and developers to revoke cloud credentials after they become publicly accessible.
The investigation identified 431,875 AWS secrets across publicly accessible material, which were reduced after deduplication to 64,024 unique keys associated with 50,654 AWS accounts. Credentials appeared in code repositories, historical Git commits, datasets, Docker images, software registries and continuous integration logs, illustrating how secrets can survive far beyond the files or projects in which they were initially placed.
Truffle Security, which conducted the research, determined that 817 of the active exposed keys were associated with companies. Among those were 526 AWS root access keys and another 242 belonging to Identity and Access Management users carrying the AdministratorAccess policy. Together, 768 credentials provided what amounted to complete control of the affected AWS environments.
Root credentials represent an especially serious exposure because the AWS account root user has extensive authority over resources and account settings. AdministratorAccess granted through IAM similarly permits actions across most AWS services. A compromised credential at either level can potentially be used to inspect infrastructure, access stored information, create additional identities, alter configurations or consume cloud resources.
The findings do not mean every one of the 9,308 active credentials provides such extensive capabilities. Successful authentication establishes that a credential remains valid but does not, by itself, reveal the permissions attached to it. Many keys may have tightly restricted access. The researchers therefore examined identifiable corporate credentials separately to determine the scale of privileged exposure.
Credential age was another significant concern. Where creation dates could be established, the median age of a still-functioning exposed key was 1,831 days, or roughly five years. The oldest usable credential identified was more than 17 years old.
Evidence of routine replacement was limited. Among 2,903 accounts where researchers could examine whether IAM users had additional access keys, only 398 had a newer credential alongside the leaked one. That represented about 13.7%, suggesting that long-lived programmatic credentials often remain untouched after being created.
Hugging Face, the widely used platform for sharing machine-learning models, datasets and applications, emerged as the largest individual location for exposed credentials in the dataset, accounting for 8,482 unique AWS key exposures. The concentration highlights an expanding security challenge created by development environments in which cloud infrastructure, artificial intelligence tools and publicly shared software increasingly intersect.
Developers frequently require cloud credentials for applications that interact with storage, databases, computing instances or other AWS services. Keys placed directly inside source code, configuration files or environment files can subsequently become exposed when projects are uploaded to public repositories or incorporated into container images.
Deleting an exposed line from a current version of software does not necessarily eliminate the risk. Credentials can remain embedded inside Git history, previous container layers, archived datasets or logs generated by automated build systems. Unless the associated key itself is deactivated or deleted, someone who discovers the old copy can potentially continue using it.
AWS security guidance treats publicly exposed credentials as compromised and recommends immediate revocation or rotation. It also encourages organisations to avoid unnecessary long-lived access keys, apply least-privilege permissions and use temporary credentials wherever practical. Secret-scanning tools can additionally be integrated into development and continuous integration pipelines to prevent credentials from being committed to repositories.
The problem has become more important as machine identities multiply across cloud infrastructure. Modern software deployments routinely connect applications, automation platforms, containers, artificial intelligence services and external APIs, each potentially requiring credentials. A forgotten machine credential can therefore survive employee departures, project migrations and infrastructure redesigns while continuing to provide programmatic access.
The research also found AWS compromise protections attached to some credentials that remained capable of authentication, showing that detection alone does not substitute for revocation by the credential owner. Organisations confronting an exposed key must also examine activity logs and associated permissions to establish whether the credential was used without authorisation.
Follow Arabian Post
Select Arabian Post as your preferred source on Google and MSN News for trusted business news and Arab politics and updates.
