Despite Amazon Web Services' (AWS) automated security measures, hundreds of leaked AWS root. Keys remain active and valid, exposing customer. Accounts to severe compromise, according to recent findings by Truffle Security and sharp. Criticism from cloud economist Corey Quinn. The revelation casts a shadow on AWS's 'Quarantine Policy,'. Which aims to mitigate damage from exposed credentials but is proving insufficient against determined attackers. This guide covers AWS Security makes an inscrutable choice in detail. This guide covers AWS Security makes an inscrutable choice in detail. This guide covers AWS Security makes an inscrutable choice in detail.
AWS Security makes an inscrutable choice: Why Are So Many AWS Root Keys Still Active?
A report by BleepingComputer on August 21, 2026, highlighted Truffle Security's four-year investigation. Revealing over 9,300 AWS access keys publicly. Exposed between August 2022 and August 2026 are still operational. Alarmingly, 526 of these were AWS root keys, granting unrestricted power over an entire cloud infrastructure. And another 242 were associated with Identity and Access Management (IAM) users holding the highly privileged AdministratorAccess policy. Truffle Security re-verified 10,616 leaked AWS keys on August 10, 2026, finding. That a staggering 88% continued to authenticate. The median age of these exposed keys was approximately five years, with some dating back 17.4 years, and 86% had never been rotated or replaced.
AWS does implement an automated response when it detects leaked credentials, applying a 'Quarantine Policy' (specifically AWSCompromisedKeyQuarantineV2) to the exposed keys. This policy is designed to block certain high-risk IAM actions. Such as creating new access keys or launching EC2 instances, with the stated. Goal of limiting potential damage from fraud-related activity. While avoiding disruption to existing customer environments. AWS also notifies affected customers via AWS Health, email, and support cases, providing guidance on remediation.
What Are the Critical Flaws in AWS's Quarantine Policy?
However, Corey Quinn, Chief Cloud Economist at Duckbill Group and a prominent voice. In cloud security, has vehemently criticized AWS's. 'considered position' as fundamentally flawed. Quinn argues that while the quarantine policy restricts some actions, it leaves a. Vast array of dangerous capabilities open to an attacker. He states, "If I get access to your credentials (much less a root credential, good god), deactivating them may very well break your workload because anything that relies on those credentials will start failing." This operational continuity focus, he contends, comes at the unacceptable cost of security.
Quinn details numerous critical vulnerabilities that persist even with a quarantined credential. An attacker can still perform extensive damage. Including unrestricted actions on Amazon RDS databases, running commands as root on EC2 instances via ssm:SendCommand or ssm:StartSession, and assuming any other role in the account using sts:AssumeRole, effectively rendering other restrictions moot.
The list of permitted malicious activities extends further: attackers can launch new instances. Through Auto Scaling service-linked roles (bypassing ec2:RunInstances denies), delete audit logs by calling cloudtrail:StopLogging and DeleteTrail, send spam emails via ses:SendEmail, or publish fraudulent text messages using sns:Publish. Perhaps most concerning are the S3 vulnerabilities. While s3:DeleteObject is denied, s3:PutObject is allowed, enabling an attacker to fill buckets to petabytes, incurring massive costs. , the policy fails to block s3:PutBucketVersioning, s3:PutObjectLockConfiguration, s3:PutObjectRetention, and s3:PutObjectLegalHold. This means an attacker can enable compliance-mode retention on existing buckets, setting unchangeable retention periods out Whether you are new to AWS Security makes an inscrutable choice or already experienced, the sections below have you covered.to 2126, which can only be removed by deleting the entire AWS account.
Beyond data manipulation and service disruption, an attacker can also access sensitive secrets. Actions like secretsmanager:GetSecretValue, ssm:GetParameter* (WithDecryption), and kms:Decrypt remain unencumbered, allowing compromised credentials to expose critical organizational secrets. The financial implications are stark: Truffle Security's report indicated. That active leaked keys generated over $420,631 in AWS spending in July alone. With some individual keys racking up over $10,000. The prevalence of old, unrotated keys further exacerbates the risk, as many organizations. Fail to implement basic credential hygiene.
What This Means for Tech Readers
This situation presents a critical security dilemma for any organization leveraging AWS. The core takeaway is that relying solely on AWS's automated quarantine for leaked. Credentials provides a false sense of security. While AWS acts quickly to apply its policy and notify users—often within minutes. Of detection—the policy's design prioritizes operational continuity over immediate, comprehensive containment. This leaves a significant window and attack surface for sophisticated adversaries. The fact that hundreds of root keys. Which grant ultimate control, remain active underscores a pervasive problem of both accidental. Exposure and insufficient remediation by account owners. Businesses must understand that a 'quarantined' key is still a highly dangerous key, capable of causing irreparable damage, data exfiltration. And massive financial loss.
What's Next for AWS Security and Its Users?
The ongoing debate highlights the urgent need for AWS to re-evaluate its 'Quarantine. Policy' to provide more robust, immediate containment. For highly privileged credentials like root keys. While AWS offers services such as Secrets Manager, GuardDuty. And Security Hub to aid in prevention and detection, the current policy's limitations. Demand a stronger default stance. For users, the path forward involves a multi-layered, proactive security strategy. Organizations must prioritize the immediate rotation and deletion of any exposed keys, treating. Every leak as a full compromise. Implementing robust secret management solutions, enforcing the use of temporary credentials via IAM roles and federation. And integrating secret scanning into CI/CD pipelines are non-negotiable best practices. , security experts recommend protecting quarantine policies themselves with AWS Organizations Service Control. Policies (SCPs) to prevent attackers from detaching. Them during the 'eventual consistency' window of IAM. Ultimately, the responsibility for securing cloud environments is shared. And users cannot afford to assume AWS's automated responses are a complete defense.
Related Resources
For more context, check our related article on Windows 11 24H2 Home and Pro Editions Face Critical Security. Deadline in October 2026.
