Leaked AWS access key: what to do in the next 10 minutes

Last updated: October 24, 2026. Steps checked against AWS's own docs on October 24, 2026.

Short answer: Deactivate the leaked access key in IAM first (deactivating is reversible; delete it once your app runs on a new key). Then check CloudTrail, because deactivating doesn't end temporary credentials that were already issued.

Which AWS keys are secret?

Secret: Access key ID (starts with AKIA) together with its secret access key
Secret: Root user access keys (the most dangerous kind)
Meant to be public: None. AWS access keys belong on servers or in roles, never in a website or app.

The next 10 minutes

Times are a rough guide. Do the first step before anything else.

1. Deactivate the key (Minutes 0-2)

IAM console → Users → the user → Security credentials → Make inactive on the leaked access key. Don't delete it yet; AWS suggests deactivating first so you can reactivate briefly if something breaks.
If the key belongs to the root user, AWS says to rotate it right away; delete root access keys you don't need or didn't create.

2. Replace it and then delete the old key (Minutes 2-5)

Create a new access key, update your app or server, and check it works. Once it does, delete the old key.
If AWS attached the AWSCompromisedKeyQuarantineV2 or V3 policy to the user, leave it in place. AWS says not to remove it and to follow the instructions in the support case it created.

3. Look for what the key did (Minutes 5-8)

Open CloudTrail → Event history and look for new access keys, IAM users, roles or policies, AssumeRole or GetSessionToken calls, EC2 instances and S3 activity you didn't do. Delete anything unauthorized.
Deactivating the key doesn't end temporary credentials already issued with it. Revoke active sessions on any role that was assumed.

4. Check every Region and your bill, then get help (Minutes 8-10)

Check resources in all Regions, including ones you never use, and compare this month's charges with last month's in Billing or Cost Explorer.
Turn on MFA for the root user, and contact AWS Support or reply to the support case if AWS opened one.

Good to know

CloudTrail's Event history covers the last 90 days.

After the first 10 minutes

Move the code that needs the key to the server (an API route, serverless function or Supabase Edge Function), keep the key in a server-only environment variable, redeploy, and re-check your live site. The general plan, with a prompt you can paste into Lovable, Bolt, Cursor or Claude Code, is in I leaked an API key in my vibe-coded app. What do I do now?

What SniffPup checks, and what it doesn't

A free SniffPup scan reads only what your live site serves to the public: secret key patterns in HTML and same-origin JavaScript (masked in the report) and public files such as /.env and /.git/config. It never uses a key it finds. It can't see your repo, your server or AWS's logs, so the steps above are always on you. A clean report is not a guarantee of security.

Sources

AWS can change its dashboard and steps at any time. If something here doesn't match what you see, follow AWS's docs and tell us.

Other providers

Run a free scan →