AWS Access Keys Committed to Source Code

What Is This Vulnerability?

AWS access key IDs and secret access keys are embedded directly in application code or configuration files. These credentials can grant broad access to AWS services including S3, EC2, Lambda, and IAM, allowing attackers to provision resources, access data, or take over the entire AWS account.

Why It Happens

Developers configure the AWS SDK with hardcoded credentials during development instead of using IAM roles or credential profiles. Quick scripts for one-time tasks often contain inline keys that later get committed. Some developers are unaware of the AWS credential chain and credential provider alternatives.

Example Code

import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";

const s3 = new S3Client({
  region: "us-east-1",
  credentials: {
    accessKeyId: "AKIAIOSFODNN7EXAMPLE",
    secretAccessKey: "wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY",
  },
});

export async function uploadFile(bucket: string, key: string, body: Buffer) {
  return s3.send(new PutObjectCommand({ Bucket: bucket, Key: key, Body: body }));
}

import { S3Client, PutObjectCommand } from "@aws-sdk/client-s3";

const s3 = new S3Client({
  region: process.env.AWS_REGION || "us-east-1",
});

export async function uploadFile(bucket: string, key: string, body: Buffer) {
  return s3.send(new PutObjectCommand({ Bucket: bucket, Key: key, Body: body }));
}

How Hackers Exploit It

Bots continuously scan GitHub for strings matching the AKIA prefix of AWS access keys. Within minutes of a key being committed, attackers can use it to spin up cryptocurrency mining instances, exfiltrate S3 data, create IAM backdoor users, or encrypt resources for ransom. AWS bills can reach tens of thousands of dollars within hours.

How to Fix It

Remove hardcoded credentials and rely on the AWS SDK default credential chain, which automatically checks environment variables, shared credential files, and IAM roles. For production workloads, use IAM roles for EC2 instances or ECS tasks. Immediately deactivate and rotate any exposed keys through the AWS IAM console.

Frequently Asked Questions