768 Leaked AWS Keys Still Have Full Admin Access — And Nobody Rotated Them

768 Leaked AWS Keys Still Have Full Admin Access — And Nobody Rotated Them 🚨

A four-year investigation by Truffle Security (the team behind the open-source scanner TruffleHog) just uncovered a massive, ongoing cloud security failure — and most affected companies still have no idea.

They scanned 431,875 exposed AWS credentials pulled from GitHub repos, Docker images, CI/CD pipeline logs, and public Hugging Face datasets. When they re-verified a sample of 10,616 keys using read-only AWS API calls, the results were brutal:

• 🔑 88% of leaked AWS access keys are still active
• 🔑 768 keys grant full admin or root-level access to corporate cloud accounts
• 🔑 526 are root access keys — the most dangerous credential type in AWS
• 🔑 Only 13.7% of leaked keys were ever rotated after exposure
• 🔑 Hugging Face, not GitHub, was the single largest leak source
• 🔑 The median leaked key stayed active for ~5 years before discovery

Why leaked keys survive this long:

1. Deleted ≠ destroyed — removing a secret from your current branch does nothing to Git history. Anyone can clone the repo and pull it from an old commit.
2. Secrets propagate — a single leaked key often ends up copied across Docker layers, datasets, and forks. Killing the source doesn't kill the copies.
3. Most orgs scan code for secrets but never check what a leaked key can actually reach in production.

If you're a developer, DevOps engineer, or maintain IAM policy — here's a quick self-check you can run right now:

aws iam list-access-keys --user-name <username>
aws sts get-caller-identity
aws iam list-attached-user-policies --user-name <username>

Full breakdown — including a complete remediation checklist and full-history secret scanning with TruffleHog — here:
https://www.xpert4cyber.com/2026/08/768-leaked-aws-keys-full-admin-access.html

What's your team's policy on rotating long-lived AWS keys? Curious how others are handling this. 👇