Researchers say large numbers of leaked Amazon Web Services (AWS) access keys remain valid and can grant full control of corporate cloud accounts. Truffle Security reports finding 768 leaked keys that provide complete access, including 526 root keys. It says 88% of the tested credentials were still working.
Both outlets describe a scenario where exposed credentials have not been fully neutralized. AWS uses a quarantine policy for keys it detects as leaked, but researchers say that containment still allows a wide range of harmful actions. Separately, Bleeping Computer reports that more than 9,300 AWS access keys exposed publicly between August 2022 and August 2026 are still active and valid. The coverage differs in scope and testing details—The Next Web focuses on a smaller set of verified keys and the effectiveness of AWS quarantine—while Bleeping Computer emphasizes the larger count of still-active exposed keys.
