AKIA…
Exposed AWS Access Key? Here's how to detect and rotate it
Leaked an AWS key (AKIA…)? Attackers spin up crypto-mining on your bill in minutes. Scan free with Trust, then deactivate & delete the key in IAM.
An AWS access key (an ID starting with AKIA plus its secret) authenticates programmatic calls to your AWS account. Anyone holding the pair can do whatever that IAM user or role can — often your entire cloud infrastructure and its billing.
What an attacker can do with a leaked AWS Access Key
- Spins up the largest GPU/EC2 instances to mine crypto — you get a five-figure bill within hours.
- Reads and exfiltrates every S3 bucket the key can reach (customer data, backups, secrets).
- Creates new IAM users and keys to persist even after you rotate the leaked one.
- Deletes resources, snapshots, and CloudTrail logs to ransom you or cover their tracks.
How AWS Access Keys get exposed
- Committed to a public GitHub repo — AWS and GitHub scan for AKIA strings and will alert you.
- Hardcoded in source, a Dockerfile, or a .env that got pushed instead of gitignored.
- Baked into a client-side bundle or mobile app where anyone can extract it.
- Pasted into a log, screenshot, Slack message, or CI build output.
Scan your repo and live site for exposed AWS Access Keys — free
Trust checks your code, git history, and shipped JavaScript. No signup, results in about a minute.
Run a free scan →How to rotate a leaked AWS Access Key
- Sign in to the IAM console → Users → select the affected user → Security credentials tab.
- Under Access keys, create a NEW access key (you can have two active at once) and store it safely.
- Update every app/service to the new key and confirm they work.
- On the old key, choose Actions → Deactivate (stops it immediately, but is reversible).
- After confirming nothing broke, choose Actions → Delete on the old key (irreversible).
- Review CloudTrail for unauthorized activity and check IAM for any users/keys the attacker created.