Despite Amazon Web Services' (AWS) automated security steps, hundreds of leaked AWS root. Keys stay active and valid. This puts customer accounts at severe risk, based on recent findings by Truffle. Security and sharp criticism from cloud economist Corey Quinn. The news casts a shadow on AWS's 'Quarantine Policy,'. Which aims to reduce damage from exposed keys but is failing to stop determined attackers. We cover AWS Security makes an inscrutable choice in detail below.
AWS Security makes an inscrutable choice: Why Are So Many AWS Root Keys Still Active?
A report by BleepingComputer on August 21, 2026, shared Truffle Security's four-year investigation. It found that over 9,300 AWS access keys exposed publicly between August 2022. And August 2026 are still working. Alarmingly, 526 of these were AWS root keys. Which give full control over an entire cloud setup. Another 242 were tied to Identity and Access Management (IAM) users holding the highly privileged policy. Truffle Security re-checked 10,616 leaked AWS keys on August 10, 2026, and found. That 88% still worked. The median age of these exposed keys was about five years, with some dating back 17.4 years. Also, 86% had never been rotated or replaced.
AWS does run an automated response when it spots leaked keys. It applies a 'Quarantine Policy' (specifically) to the exposed keys. This policy is meant to block certain high-risk IAM actions, like creating new. Access keys or launching EC2 instances. Its stated goal is to limit damage from fraud while avoiding disruption to existing customer setups. AWS also tells affected customers through AWS Health, email, and support cases. And gives guidance on how to fix the issue.
What Are the Critical Flaws in AWS's Quarantine Policy?
Corey Quinn, Chief Cloud Economist at Duckbill Group and a well-known voice in. Cloud security, has strongly criticized AWS's 'considered position' as deeply flawed. Quinn argues that while the quarantine policy blocks some actions, it leaves many dangerous options open. He says, "If I get access to your credentials (much less a root credential, good god), deactivating them may very well break your workload because anything that relies on those credentials will start failing." He contends that this focus on keeping things running comes at an. Unacceptable cost to security.
Quinn lists many critical gaps that stay open even with a quarantined key. An attacker can still cause major damage. They can run any action on Amazon RDS databases, run commands as root. On EC2 instances via or. And take on any other role in the account using. This makes other rules pointless.
The list of allowed harmful actions goes on. Attackers can launch new instances through Auto Scaling service-linked roles, which bypasses denies. They can delete audit logs by calling and. They can send spam emails via, or send scam text messages using. The S3 gaps are among the most worrying. While is blocked, is allowed. This lets an attacker fill buckets to petabytes, running up huge costs. The policy also fails to block, , , and. This means an attacker can turn on compliance-mode retention on existing buckets, setting. Unchangeable retention periods from one to 2126 years. You can only remove this by deleting the whole AWS account.
Beyond data tampering and service disruption, an attacker can also reach sensitive secrets. Actions like, , and stay open, so compromised keys can expose critical company secrets. The financial impact is stark. Truffle Security's report showed that active leaked keys drove over $420,631 in AWS. Spending in July alone. Some single keys racked up over $10,000. The high number of old, unrotated keys makes the risk worse, as many. Groups fail to follow basic key hygiene.
What This Means for Tech Readers
This situation presents a critical security dilemma for any group using AWS. The core takeaway is that relying only on AWS's automated quarantine for leaked. Keys gives a false sense of safety. While AWS acts fast to apply its policy and tell users, often within. Minutes of detection, the policy's design puts. Operational continuity ahead of full containment. This leaves a large attack window for skilled adversaries. The fact that hundreds of root keys. Which grant total control, stay active shows a widespread problem of both accidental. Exposure and weak fixes by account owners. Businesses must understand that a 'quarantined' key is still a highly dangerous key. It can cause lasting damage, data theft, and massive financial loss.
What's Next for AWS Security and Its Users?
The ongoing debate shows the urgent need for AWS to rethink its 'Quarantine. Policy' and offer stronger, faster containment, especially for root keys. While AWS offers services like Secrets Manager, GuardDuty. And Security Hub to help with prevention and detection, the current policy's limits. Demand a stronger default stance. For users, the path forward is a multi-layered, proactive security strategy. Groups must focus on the fast rotation and removal of any exposed keys. Treating every leak as a full compromise. They need to build strong secret management systems, require the use of temporary. Keys via IAM roles and federation. And add secret scanning into CI/CD pipelines. These are must-do steps. Security experts also recommend protecting quarantine policies themselves with AWS Organizations Service Control Policies (SCPs). This stops attackers from detaching them during IAM's 'eventual consistency' window. In the end, the responsibility for securing cloud setups is shared. And users cannot assume AWS's automated responses are a full defense.
Related Resources
For more context, check our target="_blank" rel="noopener noreferrer nofollow" class="text-[#F59E0B] underline underline-offset-2 hover:text-[#818CF8] font-medium" href="/windows-11-24h2-home-and-pro-reach-end-of-support-in Keep this reference handy whenever you work with AWS Security makes an inscrutable choice.-2-months-windows-11-24h2-home-and-pro-editions-face-critical-securi">related article on Windows 11 24H2 Home and Pro Editions Face Critical Security Deadline in October 2026
