Cloud Key Leak.

Accidental exposure of long-lived cloud access keys in public repositories, container images, logs, or client-side code, often abused within minutes. It belongs to the Cloud Security category of cybersecurity.

Accidental exposure of long-lived cloud access keys in public repositories, container images, logs, or client-side code, often abused within minutes.

A cloud key leak occurs when long-lived credentials (such as AWS access key IDs and secret access keys, Azure Storage account keys, or GCP service-account JSON files) are committed to public git repositories, embedded in mobile or web bundles, baked into container images, or printed in verbose logs. Automated scanners run by attackers and researchers detect these keys in seconds and immediately invoke API operations to spin up compute, exfiltrate data, or escalate privileges. Defences combine pre-commit secret scanning (gitleaks, trufflehog), provider-side detection (AWS, GitHub secret scanning), short-lived federated credentials via OIDC, immediate revocation playbooks, and CloudTrail anomaly alerting.

Defences for Cloud Key Leak typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: AWS key leak, Cloud credential leak.