2026年8月23日の
セキュリティ情報

Subject: [Security Alert] Exposure and Persistence of AWS Access Keys in Public Repositories

Dear IT/Security Team,

We are sharing critical information regarding the management of AWS access keys.

■ Overview
Recent research by Truffle Security indicates that a vast majority (88%) of leaked AWS access keys found in public repositories remain active years after exposure. A significant number of these keys provide root or AdministratorAccess privileges, posing a critical risk of full cloud environment compromise.

■ Scope
- Any environment where AWS access keys are hardcoded in source code or configuration files and pushed to public repositories, Docker images, or CI/CD logs.

■ Action Plan
1. Perform a secret scan using tools such as TruffleHog or git-secrets to identify any exposed AWS keys in your repositories.
2. Immediately deactivate any exposed keys and rotate them.
3. Transition from static access keys to IAM Roles (temporary credentials) wherever possible.
4. Enforce Multi-Factor Authentication (MFA) for all privileged accounts.

■ Reference
- Truffle Security Research Report

Priority: High
Deadline: Immediate