Hundreds of Leaked AWS Access Keys Expose Full Control Over Corporate Cloud Accounts
What Happened – More than 9,300 AWS access keys were discovered publicly exposed between August 2022 and August 2026; 817 of those keys belong to corporate accounts, including 526 root keys and 242 IAM users with the AdministratorAccess policy. At the time of reporting, 768 keys remained active, giving attackers unrestricted control of the associated AWS environments.
Why It Matters for Compliance & Audit Readiness
- Unmanaged or stale credentials violate SOC 2 CC6.1 (Logical Access) and CC6.2 (User Access Management) – controls that require documented credential lifecycle processes and evidence of regular rotation.
- The exposure demonstrates a gap in continuous monitoring; SOC 2 evidence must show that privileged keys are inventoried, reviewed, and revoked when found in insecure locations.
- Demonstrating remediation (key rotation, root‑key deletion, budget alerts) provides audit‑ready proof that the organization enforces least‑privilege and risk‑based access controls.
Who Is Affected – Technology‑SaaS providers, fintech firms, e‑commerce platforms, and any enterprise that runs workloads on AWS.
Recommended Actions
- Immediately delete all exposed root access keys and rotate any active IAM keys older than 90 days.
- Enforce a policy that forbids committing secrets to public repositories; integrate secret‑scanning tools into CI/CD pipelines.
- Enable AWS Config and CloudTrail alerts for credential creation, usage, and budget overruns; retain logs as SOC 2 evidence.
- Document the remediation steps in your access‑control register and map them to SOC 2 CC6.1/CC6.2 controls.
Source: BleepingComputer
Technical Notes – The leaked keys were found in code repositories, Docker images, CI logs, and public datasets. 17.9 % of the keys were root credentials; the median age of exposed keys was 1,831 days, and only 13.7 % had been rotated. Attackers could use these keys to exfiltrate data, deploy ransomware, or run unauthorized crypto‑miners.