Cloud access keys can provide powerful access to organisational systems, data and computing resources.
Research identified more than 9,300 AWS access keys that had been publicly exposed between 2022 and 2026 but reportedly remained active.
Some of the exposed credentials included root keys and IAM accounts with administrator privileges.
Public source-code repositories, datasets, container images and CI/CD logs were among the locations where credentials had been exposed.
Kenyan organisations using AWS should treat any credential discovered in a public source as compromised.
The credential should be revoked and rotated immediately rather than waiting for evidence that it has been misused.
Organisations should also scan development repositories and automated deployment pipelines for secrets, eliminate unnecessary root keys, enforce least privilege and configure alerts for abnormal activity or unexpected cloud spending.
Once a credential has been publicly exposed, it should no longer be considered secret.