cyber.hendryadrian.com
Security Report · bleepingcomputer.com

Researchers Find More Than 9,300 Exposed AWS Keys Still Active

· Original article ↗

Summary

Truffle Security reports that more than 9,300 publicly exposed AWS keys remained active. Findings include company-linked and root keys, AdministratorAccess credentials, and 8,482 exposures from Hugging Face; researchers recommend revoking or rotating exposed keys.

Key points

  • Truffle Security reports that more than 9,300 publicly exposed AWS access keys remained active; 817 were linked to companies, including 526 root keys.
  • Researchers identified 242 keys associated with IAM users holding AdministratorAccess, which provides broad permissions across AWS services and resources.
  • Hugging Face accounted for 8,482 unique exposed key exposures; 17.9% of those keys were root keys.
  • Of 10,616 keys for which researchers had complete credentials to recheck, 88% continued to authenticate as of August 10.
  • Among 2,903 keys with creation dates, the median age was 1,831 days; only 13.7% had a newer key associated with the same user.
  • Truffle Security says it limited testing to read-only metadata and notified identifiable credential owners.
  • Researchers recommend deleting root keys, reviewing credential age, rotating or revoking exposed keys, and configuring budget alerts.

Article Details

Publisher
BleepingComputer
Report Period
2022-08 to 2026-08
Scope
Truffle Security's analysis of publicly exposed AWS access keys and credentials.
Sample Size
431,875 AWS secrets identified; 64,024 unique AWS keys across 50,654 accounts after deduplication. Re-verification subset: 10,616 keys.
Key Statistics
  • More than 9,300 publicly exposed AWS access keys remained active; 88% of the 10,616 keys with complete credentials continued to authenticate as of August 10.
  • Truffle Security linked 817 exposed keys to companies: 526 were root keys and 242 belonged to IAM users with AdministratorAccess.
  • Hugging Face accounted for 8,482 unique exposed AWS key exposures; 17.9% of those keys were root keys.
  • Of 2,754 readable accounts, 262 had a budget alert configured.
  • Among 2,903 keys with creation dates, median age was 1,831 days; the oldest was 17.4 years old.
Recommendations
  • Delete all root access keys.
  • Review IAM credentials by age and rotate or revoke exposed keys.
  • Configure budget alerts.
  • Treat any credential committed to a public source as compromised.

Vendors

Amazon Web ServicesMore than 9,300 AWS access keys exposed over a four-year period are still active, with hundreds tied to companies, root accounts, and AdministratorAccess users.

Products

AWSMore than 9,300 AWS access keys exposed over a four-year period are still active, with hundreds tied to companies, root accounts, and AdministratorAccess users.Hugging Facefull control of AWS environments, including data theft, account takeover, and cryptomining, with Hugging Face being the largest source of exposed keys.

Related Articles