Truffle Security Launches Trufflehog AWS Analyze To Reduce Remediation Time On Leaked AWS Credentials

New research reveals how often AWS keys are exposed, why leaked AWS credentials are so hard to remediate and how little teams know about what they can access

SAN FRANCISCO--(BUSINESS WIRE)--Truffle Security, the company that makes it easy to find, verify, and remediate secrets, today announced TruffleHog AWS Analyze, a new addition to TruffleHog Enterprise. TruffleHog AWS Analyze enriches found AWS credentials to highlight permissions and access levels, so a security team can assess the risk and prioritize its response.

TruffleHog Enterprise already finds and verifies leaked credentials across 800+ secret types, and with TruffleHog Analyze, it can also provide identity and access context, first for SaaS platforms and Google Cloud, and now for AWS. With this addition, teams running multi-cloud environments can identify a leaked secret, understand what it can access, and prioritize remediation across all three surfaces.

TruffleHog AWS Analyze shows full context for leaked keys

Once an AWS credential leaks, understanding its impact can require manually piecing together identity, permissions, and IAM relationships. TruffleHog AWS Analyze does that investigation for security teams. It identifies the AWS user or role behind the credential, maps its effective permissions, and reveals which roles it can assume to gain additional access, giving responders a clearer picture of the potential blast radius. It also flags when AWS returns incomplete results, so teams know when the analysis provides only a partial view.

"Agentic workflows are creating, using, and exposing AWS credentials faster than any team can track. Once a key ends up embedded in an automated process, it is copied and reused well beyond its original purpose, often persisting long after anyone remembers it exists. Identifying a leaked credential is one challenge but understanding what it can actually reach can be difficult to determine. TruffleHog AWS Analyze gives security teams that context as part of the same workflow, so they know exactly what has been exposed and fix it easily," said Dylan Ayrey, CEO and founder of Truffle Security.

AWS keys are exposed frequently; fixing them lags behind

AWS keys are among the most frequently leaked credentials, and many stay active long after they have been exposed. Because a single AWS key can reach compute, storage, databases, etc., a leak doesn't just expose one system, it exposes the permissions that control every other system.

Truffle Security Research recently verified 64,024 unique leaked AWS keys pulled from public code, container images, and datasets, and found that 88% still were active. The median leaked key had been sitting active for five years, and only 14% had ever been rotated. Among the keys researched closely, 84% carried full administrator access, and 1 in 6 was a root key, which provides access to an AWS account.

Surprisingly, 929 of these credentials had already been flagged by AWS's own compromised-key quarantine policy, some more than three years earlier and every one still authenticated. Even though AWS had detected the exposure, no one had remediated them.

When TruffleHog scanned 7.6 petabytes of public AI training data on Hugging Face, it found the same exposure at scale. 3,343 live AWS keys were still live, more than 900 of which could list S3 buckets holding at least 51.7 TB of private data.

"We proactively scan the Hub with TruffleHog and notify publishers by email when we find a verified secret. But an alert is only the beginning. Truffle Security's research is a reminder that a leaked key is vulnerable until someone rotates it. Showing teams the identity and access behind a credential is how you turn a notification into action," said Julien Chaumond, CTO at Hugging Face.

If you publish models or datasets on Hugging Face, you will receive an email when a verified secret is detected. Users can check huggingface.co/settings/notifications to confirm those alerts are still on, and rotate rather than delete any key that has been exposed.

Combined with TruffleHog Enterprise's ability to find and verify every instance of a leaked key, TruffleHog AWS Analyze adds access context teams need to remediate faster.

Get TruffleHog Analyze for AWS

TruffleHog AWS Analyze is available now as an add-on to TruffleHog Enterprise.

- Read the blog on TruffleHog AWS Analyze
- Learn more at TruffleHog AWS Analyze

About Truffle Security

For more information, reach out to press@trufflesec.com

Contacts

press@trufflesec.com