Signs of Leaked Access Keys
Recognize the findings that point to stolen long-term credentials.
What a Leaked Key Means
An IAM access key is a long-term credential — an access key ID and secret — that lets code or a user call AWS APIs. If it leaks, an attacker can act as that identity from anywhere.
Leaked keys are one of the most common AWS breaches, usually because a key was hardcoded and pushed to a public repository.
How Keys Leak
Keys escape in predictable ways:
- Committed to a public GitHub repository.
- Embedded in a mobile or client-side app.
- Logged in plaintext or shared over chat.
- Stored in a misconfigured public S3 bucket.
Long-term keys are the riskiest credential precisely because they do not expire on their own.