Hundreds of Leaked AWS Access Keys Expose Corporate Cloud Environments

According to a report published by BleepingComputer, more than 9,300 Amazon Web Services (AWS) access keys were publicly exposed between August 2022 and August 2026 and are still active and valid. The leaked credentials were discovered in publicly accessible locations and, if used by threat actors, would provide full unauthorized control over the associated corporate AWS accounts.

The exposed keys span a four-year window, indicating a persistent issue with credential hygiene and secret exposure in cloud infrastructures. Because AWS access keys function as primary authentication tokens for the AWS API, any actor in possession of a valid key can perform actions permitted by the associated IAM policies, including reading and exfiltrating data, launching or terminating instances, and pivoting into other cloud resources.

The report notes that there is no patch for leaked credentials; the primary mitigation involves rotating and revoking exposed keys, enforcing least-privilege IAM policies, and using dedicated secret management services such as AWS Secrets Manager or Parameter Store. Security teams are advised to rotate credentials regularly, audit access keys for unauthorized use, and monitor API activity for signs of abuse.

The findings highlight the continued risk of hardcoded or accidentally committed credentials in code repositories, documentation, and configuration files. The cloud security community is urged to review exposure histories and implement automated scanning to detect and revoke compromised keys before they can be exploited.