CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Amazon Web Services

product · product:amazon-web-services single-source

Coverage
1
first 2026-08-24 → last 2026-08-24
Latest activity
2026-08-24
88% of leaked AWS keys still authenticate, and the measured leak surfaces are Git history, dataset repos…
Peak priority
notable
1 notable
Targets
public-sector
sectors: public-sector, technology, finance
Sources cited
1
1 hosts

Action items (1)

Do-now tasks recorded on the entries about Amazon Web Services, newest first. Check the date before acting on an older one.

  • Scan full Git history, published container image layers, package-registry artefacts and CI job logs for AWS credentials (not just the current working tree) and treat every hit as live until a caller-identity check proves otherwise, because 88% of the keys in this study still authenticated.
    2026-08-2488% of leaked AWS keys still authenticate, and the…

Defender insights

What each entry about Amazon Web Services tells a defender to do, newest first.

2026-08-24NOTABLE88% of leaked AWS keys still authenticate, and the measured leak surfaces are Git history, dataset repos, images, registries and CI logs, not the working tree

Story timeline

  1. 2026-08-24Truffle Security re-tested 10,616 leaked AWS key pairs and 88% still authenticate; 768 of them give full control of a company account, and none of the measured leak surfaces is the current working tree
    research88% of leaked AWS keys still authenticate, and the measured leak surfaces are Git history, dataset repos, images, registries and CI logs, not the working tree

Hunting pivots

Releases covered
Amazon Web Services
Tags
cloudidentityinfo-disclosuresupply-chain
ATT&CK techniques (5 across 7 tactics)

5 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts: Cloud Accounts
  • PersistenceValid Accounts: Cloud Accounts
  • Privilege EscalationValid Accounts: Cloud Accounts
  • StealthValid Accounts: Cloud Accounts
  • Credential AccessUnsecured Credentials: Credentials In Files
  • DiscoveryCloud Service Discovery · Cloud Infrastructure Discovery
  • CollectionData from Information Repositories: Code Repositories

Initial Access TA0001

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-24/leaked-aws-keys-still-authenticate-git-history-ci-logs · ATT&CK page ↗

Persistence TA0003

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-24/leaked-aws-keys-still-authenticate-git-history-ci-logs · ATT&CK page ↗

Privilege Escalation TA0004

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-24/leaked-aws-keys-still-authenticate-git-history-ci-logs · ATT&CK page ↗

Stealth TA0005

T1078.004Valid Accounts: Cloud Accounts×1

Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.

Evidence: 2026-08-24/leaked-aws-keys-still-authenticate-git-history-ci-logs · ATT&CK page ↗

Credential Access TA0006

T1552.001Unsecured Credentials: Credentials In Files×1

Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.

Evidence: 2026-08-24/leaked-aws-keys-still-authenticate-git-history-ci-logs · ATT&CK page ↗

Discovery TA0007

T1526Cloud Service Discovery×1

An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.

Evidence: 2026-08-24/leaked-aws-keys-still-authenticate-git-history-ci-logs · ATT&CK page ↗

T1580Cloud Infrastructure Discovery×1

An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.

Evidence: 2026-08-24/leaked-aws-keys-still-authenticate-git-history-ci-logs · ATT&CK page ↗

Collection TA0009

T1213.003Data from Information Repositories: Code Repositories×1

Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.

Evidence: 2026-08-24/leaked-aws-keys-still-authenticate-git-history-ci-logs · ATT&CK page ↗

Entries about Amazon Web Services (1)

2026-08-24 · view entry permalink →

NOTABLENATOB2

Truffle Security re-tested 10,616 leaked AWS key pairs and 88% still authenticate; 768 of them give full control of a company account, and none of the measured leak surfaces is the current working tree

Truffle Security re-verified 10,616 leaked AWS key pairs on 2026-08-10, a subset with complete credentials drawn from a scanned population of 64,024 unique verified AWS key pairs across 431,875 public findings surfaced between August 2022 and August 2026, and reports that 88% still authenticate (Truffle Security, 2026-08-19). Of the broader population, 10,625 keys (16.6%) were root keys across 9,945 distinct accounts. Within the enumerable subset described below, only 25 keys (0.9%) were created in the last thirty days, and Truffle's reading of that is blunt: almost none of the population leaked recently, and the count has been building for years.

The privilege picture is what makes it operational. Crossing ownership against privilege, Truffle states: "The two sets do not overlap, so 768 live keys give full control of a company AWS account", 526 root keys plus 242 IAM users carrying AdministratorAccess, derived from a wider set of 817 business-linked keys, with the remaining 49 scoped below administrator. Separately, 130 of the live root keys sit on organization-management accounts, which control every member account in the organisation beneath them. Age and hygiene compound it: "The median live leaked key is five years old and has never been rotated", 1,831 days, measured across the 2,903 keys that permitted access-key enumeration, of which only 13.7% had any newer key alongside the leaked one, with the oldest live key 17.4 years old. On the accounts where budget data was readable, "90.5% of leaked-key accounts have none," and where a budget did exist the median configured limit was $8, the free-tier guardrail rather than a control. Truffle also found that 929 of 7,590 active IAM users (12%) already carry AWS's own compromised-key quarantine policy, meaning AWS itself detected the exposure and restricted them, and that 112 of those carry the pre-2023 version of that policy, AWS flagged them at least three years ago and they still authenticate. Spend on the readable set was mostly negligible at a $0.03 median, but with a real tail: 50 accounts spent over $1,000 in the preceding month, nine over $10,000, and the readable set $420,631 in July alone.

The finding a defender should act on is the source distribution, not the counts. Truffle names five measured surfaces (Git history, public dataset repositories, container images, package registries and CI logs) and ranks only one of them: the largest single source is a public machine-learning dataset platform, with 8,482 unique live keys across 3,394 public datasets, whose keys skew most privileged of any source it tracks at 17.9% root. It publishes no ordering among the other four, so none should be inferred. None of those is the current working tree, which means the reassurance a team takes from a clean secret scan of HEAD is answering a different question from the one that matters: a credential deleted in a later commit is still in the object history, a credential removed in a later image build is still in the published layer, and a credential echoed by a build step is still in the job log long after the pipeline changed.

The median live leaked key is five years old and has never been rotated.

The two sets do not overlap, so 768 live keys give full control of a company AWS account.

90.5% of leaked-key accounts have none.

Truffle Security 2026-08-19
research24 Aug 09:15Zsingle-sourceOpen finding →
Sources: Truffle Security

explore in graph

Where this entity is cited

  • Research1

Source distribution

  • trufflesecurity.com1 (100%)
All cited sources (1)