What happens when an AWS access key leaks?
6 mins read
Quick answer: Bots find it in minutes. They launch big EC2 instances to mine crypto, or burn Bedrock tokens, often in a region you never use. Bills of $10,000 to $60,000 in a day are not rare. AWS may cut the bill if you ask. It rarely drops it to zero. Rotate the key first, then hunt the resources.
It happens to careful people. You push a config file with a key in it. Or a key meant for one small job also unlocks an expensive service. Either way, someone else is now spending your money. Here is what that looks like, and what to do in the first hour.
How fast does a leaked key get used?
Minutes. Bots watch public GitHub for anything that looks like an AWS key. One developer committed a secret on a Tuesday. Scrapers picked it up in 11 minutes. By Thursday the bill was $47,000.
The key does not have to be in a repo. Another team had keys stolen off an EC2 instance. The thief spent $14,000 in 24 hours on Bedrock, the AWS service that runs LLM calls.
What do they buy with your key?
Two things, most of the time.
Compute. Dozens of the largest EC2 instances, running crypto miners. They pick regions you never use, so nothing looks wrong on your usual dashboard.
Tokens. Bedrock and other LLM APIs. One FinOps team watched about $62,000 go out in under a day. Their line stuck with me: detection is not containment. Knowing is not the same as stopping.
The thief gains little. One story going around LinkedIn says the hacker made $800 and the AWS bill was $45,000. I cannot verify that one. The ratio sounds right.
Is it only an AWS problem?
No. The same pattern runs on every cloud. A student put a Gemini key on GitHub and got a $55,444.78 bill. Google refused to waive it. Another customer had a $7 budget set and still woke up to $18,000. A budget alert is a message. It is not a brake.
Do I have to pay?
Mostly, yes. AWS support does look at these cases. Sometimes they cut the bill. Sometimes they refund only part of it. You always have to ask, and you have to show what you did to stop it.
Nobody at AWS gets paged when your bill doubles. AWS bills what the key used. The person who finds out is you, on the invoice, unless something tells you sooner.
Do not be the one who has to pay.
What do I do in the first hour?
Speed matters more than a clean plan. In this order:
Deactivate the key. Open IAM, the AWS console for users and keys. Under Security credentials, make it inactive. Do this before anything else. Rotate every other key on the account too. Assume they took more than one.
Check every region. Open EC2 in each region, not just yours. Look for instances you did not create, plus spot requests and launch templates, which let them relaunch after you clean up. Do the same for Bedrock, SageMaker and Lambda.
Read CloudTrail. It is the log of every API call on your account. Filter on the leaked key ID. It shows every call they made, where, and when it started.
Terminate what they built. Instances, volumes, snapshots, IAM users and roles they added. Look for a backdoor user with admin rights.
Open a support case. Say what happened, when you found it, and what you did. Ask for a billing adjustment. Be honest and fast. The sooner you report, the better the odds.
Turn on alerts before you sleep. If you had none, that is why you found out from the invoice.
How do I stop it happening again?
No long-lived keys in code. Ever. Use IAM roles on EC2, ECS and Lambda. Use short-lived credentials from your identity provider for people.
Least privilege. A key for one job gets rights for one job. A maps key must not be able to call an LLM.
Secret scanning. Turn on GitHub secret scanning and push protection. Add a pre-commit hook that blocks anything that looks like a key.
Cost alerts as the last line. Every control above can fail. A cost alert catches the failure while it is still hundreds, not tens of thousands.
How does watchmy.cloud help here?
Two ways. First, we never hold a key of yours. Connect AWS. Read-only billing access. No keys. No access to what you run. One CloudFormation template, about two minutes. If our servers were breached, there is no key to steal.
Second, we are the last line. We check your spend every hour. An hour that costs three times what it normally costs fires an alert. A day that runs 30% over your 7-day average fires one too. Both rules are on from the moment you connect. A miner in a region you never use shows up hours after it lands in the data, not on the invoice. Send it where work happens. Slack for fast triage. Jira for follow-up. API when you want control.
A flat $49 a month. Here is how it works. We are a small team, and this is all we do. For the other eight ways a bill jumps, read why did my AWS bill suddenly increase.
Watching AWS spend is our full-time job. You focus on your product and sleep well.
FAQ
How fast can a leaked AWS key be abused? Within minutes. Bots scan public GitHub for key patterns all day. One documented case went from commit to first stolen instance in 11 minutes.
What do attackers run with a stolen AWS key? Large EC2 instances for crypto mining, and LLM calls on Bedrock. They pick regions you do not use, so your normal dashboard stays quiet.
Will AWS refund charges from a leaked key? Sometimes, and rarely in full. You must open a support case, show that you rotated the key and removed the resources, and ask. Partial refunds are common.
How do I check if my AWS key was used by someone else? Open CloudTrail and filter by the access key ID. It lists every API call, the region, and the source IP. Then check EC2 in every region for instances you did not launch.
Can AWS Budgets stop a leaked key from spending? No. Budgets send a message when spend crosses a line you set. They do not stop the spend. Budget actions can restrict IAM, but you have to set that up first.
How do I keep AWS keys out of GitHub? Do not create long-lived keys for code. Use IAM roles. Turn on GitHub secret scanning and push protection, and add a pre-commit hook that blocks key patterns.
See it before you connect anything: live demo, no sign-up.
More
