768 Leaked Corporate AWS Keys Held Full Admin Rights ◆ Truffle Security Co.
trufflesecurity.com
We re-verified 10,616 leaked AWS keys that surfaced publicly between August 2022 and August 2026. 88% still authenticate, and 768 of the live ones give full control of a company AWS account. The median leaked key is five years old and has never been rotated.
  • zwerg@feddit.orgEnglish
    4·
    2 months ago

    Why the fuck would you create keys for the root of your AWS accounts? Also, best practice is to not have any key live longer than 1 hour. So much is wrong here…