Cloud Credential Exposure — 768 Leaked AWS Access Keys Still Active with Full Admin Privileges

In August 2026, researchers uncovered 768 publicly exposed AWS access keys still active and granting full administrative control of corporate cloud accounts — a finding that mirrors recurring supply-chain exposure patterns where developer secrets are committed to public repositories or embedded in CI/CD pipelines. AWS key pairs (access key ID + secret access key) are the highest-value credential class in cloud infrastructure: a single leaked key grants IAM-equivalent access to S3 buckets, EC2 instances, and RDS databases without MFA. This demo uses OPSWAT Proactive DLP to intercept a configuration file bundle (a realistic cloud-credentials pack including AWS credentials, GCP service-account JSON, and a Kubernetes kubeconfig) before it can be transmitted outside the organization. The DLP engine identifies active AWS key patterns (AKIA/ASIA prefixes + 40-char secret), GCP service-account private-key PEM, and kubeconfig bearer tokens, blocking exfiltration at the gateway — the same control that would have prevented the 768-key exposure had it been deployed at the source organization's file-egress point.