Truffle Security re-tested 10,616 leaked AWS key pairs and 88% still authenticate — 768 of them give full control of a company account, and none of the measured leak surfaces is the current working tree
Truffle Security re-verified 10,616 leaked AWS key pairs on 2026-08-10, a subset with complete credentials drawn from a scanned population of 64,024 unique verified AWS key pairs across 431,875 public findings surfaced between August 2022 and August 2026, and reports that 88% still authenticate (Truffle Security, 2026-08-19). Of the broader population, 10,625 keys (16.6%) were root keys across 9,945 distinct accounts. Within the enumerable subset described below, only 25 keys — 0.9% — were created in the last thirty days, and Truffle's reading of that is blunt: almost none of the population leaked recently, and the count has been building for years.
The privilege picture is what makes it operational. Crossing ownership against privilege, Truffle states: "The two sets do not overlap, so 768 live keys give full control of a company AWS account" — 526 root keys plus 242 IAM users carrying AdministratorAccess, derived from a wider set of 817 business-linked keys, with the remaining 49 scoped below administrator. Separately, 130 of the live root keys sit on organization-management accounts, which control every member account in the organisation beneath them. Age and hygiene compound it: "The median live leaked key is five years old and has never been rotated" — 1,831 days, measured across the 2,903 keys that permitted access-key enumeration, of which only 13.7% had any newer key alongside the leaked one, with the oldest live key 17.4 years old. On the accounts where budget data was readable, "90.5% of leaked-key accounts have none," and where a budget did exist the median configured limit was $8 — the free-tier guardrail rather than a control. Truffle also found that 929 of 7,590 active IAM users (12%) already carry AWS's own compromised-key quarantine policy, meaning AWS itself detected the exposure and restricted them, and that 112 of those carry the pre-2023 version of that policy — AWS flagged them at least three years ago and they still authenticate. Spend on the readable set was mostly negligible at a $0.03 median, but with a real tail: 50 accounts spent over $1,000 in the preceding month, nine over $10,000, and the readable set $420,631 in July alone.
The finding a defender should act on is the source distribution, not the counts. Truffle names five measured surfaces — Git history, public dataset repositories, container images, package registries and CI logs — and ranks only one of them: the largest single source is a public machine-learning dataset platform, with 8,482 unique live keys across 3,394 public datasets, whose keys skew most privileged of any source it tracks at 17.9% root. It publishes no ordering among the other four, so none should be inferred. None of those is the current working tree, which means the reassurance a team takes from a clean secret scan of HEAD is answering a different question from the one that matters: a credential deleted in a later commit is still in the object history, a credential removed in a later image build is still in the published layer, and a credential echoed by a build step is still in the job log long after the pipeline changed.
The median live leaked key is five years old and has never been rotated.
The two sets do not overlap, so 768 live keys give full control of a company AWS account.
90.5% of leaked-key accounts have none.
Defender actions
- Scan full Git history, published container image layers, package-registry artefacts and CI job logs for AWS credentials — not just the current working tree — and treat every hit as live until a caller-identity check proves otherwise, because 88% of the keys in this study still authenticated.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Persistence TA0003
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Privilege Escalation TA0004
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Stealth TA0005
T1078.004Valid Accounts: Cloud Accounts
Valid accounts in cloud environments may allow adversaries to perform actions to achieve Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Cloud accounts are those created and configured by an organization for use by users, remote support, services, or for administration of resources within a cloud service provider or SaaS application. Cloud Accounts can exist solely in the cloud; alternatively, they may be hybrid-joined between on-premises systems and the cloud through syncing or federation with other identity sources such as Windows Active Directory.
Credential Access TA0006
T1552.001Unsecured Credentials: Credentials In Files
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Discovery TA0007
T1526Cloud Service Discovery
An adversary may attempt to enumerate the cloud services running on a system after gaining access. These methods can differ from platform-as-a-service (PaaS), to infrastructure-as-a-service (IaaS), or software-as-a-service (SaaS). Many services exist throughout the various cloud providers and can include Continuous Integration and Continuous Delivery (CI/CD), Lambda Functions, Entra ID, etc. They may also include security services, such as AWS GuardDuty and Microsoft Defender for Cloud, and logging services, such as AWS CloudTrail and Google Cloud Audit Logs.
T1580Cloud Infrastructure Discovery
An adversary may attempt to discover infrastructure and resources that are available within an infrastructure-as-a-service (IaaS) environment. This includes compute service resources such as instances, virtual machines, and snapshots as well as resources of other services including the storage and database services.
Collection TA0009
T1213.003Data from Information Repositories: Code Repositories
Adversaries may leverage code repositories to collect valuable information. Code repositories are tools/services that store source code and automate software builds. They may be hosted internally or privately on third party sites such as Github, GitLab, SourceForge, and BitBucket. Users typically interact with code repositories through a web application or command-line utilities such as git.
Sources
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.