The modern architecture of enterprise digital infrastructure relies heavily on cloud computing, with Amazon Web Services (AWS) standing as a foundational pillar for organizations worldwide. Corporations utilize AWS to orchestrate databases, deploy serverless applications, manage complex domain names, and host web applications. However, this expansive operational footprint brings profound security responsibilities. A sprawling investigation spanning a four-year period from August 2022 to August 2026 has uncovered an alarming volume of security oversights: more than 9,300 AWS access keys that were publicly exposed continue to remain active and valid.
Security researchers tracking this vast trove of leaked credentials have highlighted a deeply concerning reality. Out of the thousands of vulnerable assets cataloged, hundreds are directly tied to corporate entities, with a staggering proportion consisting of root accounts or Identity and Access Management (IAM) configurations carrying unrestricted administrative privileges. This ongoing exposure underscores a systemic vulnerability in how development teams manage secrets, highlighting the critical gap between cloud provisioning convenience and rigorous cybersecurity hygiene.
To quantify the sheer scale of the phenomenon, investigators audited code repositories, Git history logs, specialized datasets, Docker images, public registries, and Continuous Integration (CI) logs. Across these varied environments, the search surfaced over 431,875 distinct AWS secrets. After stripping out duplicates, the team extracted 64,024 unique AWS keys mapping back to more than 50,600 individual AWS accounts.
When narrowing the scope down to the subset of keys possessing complete, verifiable credentials, researchers focused on a sample of 10,616 items. The results of the re-verification process were startling: 88% of those credentials successfully authenticated when tested. Among those live keys, hundreds possessed absolute, unmitigated power over corporate cloud architecture. Specifically, 817 exposed keys were explicitly linked to commercial enterprises, and 526 of those functioned as AWS root keys—the absolute highest level of identity within the ecosystem, completely bypassing standard IAM restrictions.
Furthermore, 242 keys mapped directly to IAM users endowed with the AdministratorAccess policy. This specific designation grants holders full authorization to create, modify, view, and delete virtually every service and resource contained within an AWS account. The convergence of these permissions means that anyone possessing these credentials holds absolute sovereignty over the impacted business operations.
The implications of such profound access falling into malicious hands are severe. Full management control over an enterprise cloud environment enables an external attacker to execute a wide spectrum of malicious activities. Threat actors can seamlessly access, exfiltrate, or permanently wipe sensitive, mission-critical corporate data. They can hijack underlying servers and applications, subtly alter network configurations, and spin up unauthorized administrator accounts to ensure persistent, long-term access even if initial points of entry are patched.
Beyond data exfiltration and sabotage, financially motivated cybercriminals frequently leverage compromised administrative credentials to launch illicit cryptomining operations. By harnessing massive corporate cloud compute resources for unauthorized cryptocurrency generation, attackers can rapidly accumulate enormous financial bills for the victimized company before detection occurs. Compounding this risk, researchers discovered a startling lack of baseline financial safeguards: out of thousands of readable accounts evaluated during the assessment, only a minor fraction had proactive budget alerts configured to notify administrators of sudden, massive cost spikes.
The investigation also illuminated the modern vectors driving these exposures, pointing to collaborative development ecosystems as unexpected hubs for risk. For instance, platforms heavily utilized by developers to share artificial intelligence models, datasets, and machine learning applications—such as Hugging Face—emerged as the single largest source of leaked AWS credentials in the study, accounting for thousands of unique key exposures. The rapid, iterative nature of AI development and model sharing frequently leads to inadvertent secrets spillage, as developers hardcode credentials into public datasets or configuration scripts without realizing the global visibility of their repositories.
An analysis of the lifecycle of these exposed credentials revealed systemic neglect regarding basic identity governance and key rotation practices. For the subset of keys with discernible creation dates, the median age of the exposed credentials spanned approximately five years, while the oldest active key identified had been in existence for over 17 years. Furthermore, only a tiny fraction of these entries featured a newer access key associated with the same user profile, strongly indicating that routine credential rotation was largely ignored across the affected organizations.
Mitigating these systemic vulnerabilities requires a fundamental shift in how organizations approach cloud credential management. Cybersecurity experts emphasize several imperative defense strategies. First, organizations should immediately delete all root access keys, as daily operational workflows rarely require root-level access and safer alternative practices exist. Second, security teams must regularly audit and review IAM credentials based on age and usage patterns, systematically revoking or rotating stagnant keys.
Any credential accidentally committed to a public source should be treated as entirely compromised, necessitating immediate revocation rather than a simple code clean-up. Additionally, configuring comprehensive budget alerts is essential to catch anomalous resource consumption before financial and operational damage escalates.
Cloud providers operate under a shared responsibility model, wherein the platform secures the underlying infrastructure while the customer remains entirely accountable for safeguarding their data, access controls, and identity configurations. In response to these findings, cloud providers routinely emphasize that affected customers are notified upon the discovery of exposed secrets, and automated quarantine policies are often deployed to mitigate risks without disrupting vital IT operations. Ultimately, as software development accelerates and integrates deeply with artificial intelligence and distributed codebases, securing the keys to the cloud kingdom remains an urgent, ongoing battle for enterprise security professionals worldwide.
