Developer's AWS Key Leak Results in Over $6,600 Bill in One Week
A developer who has been using Amazon Web Services (AWS) for a long time reported that their usual monthly bill of around $500 surged to over $6,600 within just 7 days in September, leading to a suspension email received in the early morning. CloudTrail indicated that the Identity and Access Management (IAM) key had been leaked, and attackers used scripts to launch five completely unfamiliar c5.2xlarge instances, generating about 70TB of outbound traffic, with the source IP being a residential broadband in the U.S., suspected to be used as proxy nodes for bandwidth sales.
Minutes before the suspension, the attackers created an IAM user named bedrock-console-4, mimicking an official service, almost establishing a persistent backdoor. The developer suspects that the key was leaked during the use of a third-party model API. Damage control measures included evidence collection, timeline creation, backdoor deletion, instance termination, key rotation, and drafting a fraud complaint. After submitting evidence, AWS confirmed it was a case of key leak fraud and expressed willingness to waive the over $6,600 charge, allowing the account to be reinstated.
Similar techniques have become a fixed subject in English security research. Fortinet refers to the misuse of Bedrock inference resale as LLMjacking, where stolen admin keys can create identities, subscribe to base models in the Marketplace, and sell inference externally, with daily exposures previously estimated in the tens of thousands of dollars. Sysdig recorded intrusions that took less than eight minutes from stolen credentials to backdoor admin user creation, attempting to launch high-priced GPU instances. AWS's own incident guide lists SSRF credential theft followed by cross-region calls to Bedrock as a standard scenario. Wiz demonstrated that model gateway passthrough could access instance metadata and extract temporary keys.
The keys themselves remain widely active. Truffle Security reviewed over 10,000 publicly leaked AWS credentials in August, finding that about 88% were still valid; 768 pairs were linked to enterprise accounts with full management permissions, including 526 root keys and 242 with AdministratorAccess, with a median leak age of about five years. Datadog also observed phishing attacks that cloned consoles and real-time forwarded multi-factor authentication codes. AWS's public process requires rotating exposed keys and may apply the AWSCompromisedKeyQuarantineV2 policy to affected users.
The victim's four lessons align with vendor documentation: treat keys as consumables and rotate them regularly; minimize permissions granted to third parties; multi-factor authentication protects the console, while access keys are like copies of a door key; fraudulent bills can be disputed with a chain of evidence. They emphasized that local regulations cannot prevent keys from being leaked through intermediary channels.
The market mechanism is that stolen computing power is monetized. Buyers are underground purchasers seeking cheap proxy bandwidth or reselling inference; sellers are scripts holding long-term leaked keys. Funds flow from the victim's cloud bill to instance hourly fees and outbound traffic charges, then become nodes or model interfaces sold by attackers. Beneficiaries are cloud vendor customer service and security products that can quickly identify fraud and issue credits; the pressured party is individual developers who paste production keys into third-party chat boxes. The event driver is the suspension email and a charge of over $6,600 that can be credited back, rather than a new vulnerability number.
The console has multi-factor authentication, but access keys do not. Adding an input box at the intermediary can lead to billing based on traffic.
Source: Public Information
ABAB AI Insight
This is not a novel vulnerability; it is a case of long-term keys encountering new leakage channels. After cryptocurrency mining, bandwidth proxying and model inference have become two ways to monetize stolen IAM keys. Fortinet and Sysdig have compressed the timeline to minute-level: creating users, subscribing to the Marketplace, launching instances. The victim's near-miss with bedrock-console-4 is just a persistent disguise under the same script as an official service name. Third-party model intermediaries move keys from environment variables into the dialogue context, effectively handing over production access control to another set of logs that are not bound by contract.
The capital path is extremely short. Attackers do not buy GPU clusters but rent hourly machines from the victim's account, using residential IPs to reduce bans, and sell the 70TB outbound traffic as proxies. On the cloud vendor side, they use credits to retain customers: acknowledging fraud, waiving fees, and unblocking accounts to prevent a single incident from becoming a public trust breach. The 768 active management keys identified by Truffle indicate that the discipline of key rotation has not kept pace with the speed of leaks. Money flows from the developer's credit card reserves into AWS receivables, and after fraud confirmation, it is allocated back from revenue.
Analogies include scanning for AKIA prefixes on GitHub, pasting .env files in Slack, and gateways like LiteLLM that can access 169.254.169.254. The industry phase is controlling key lifetimes. Whoever can turn access keys into short-lived, scope-locked sessions will prevent intermediaries from obtaining five waves of c5 instances even if they leak. Beauty and office software treat keys as configurations; the cloud treats keys as currency.
The structural change is that technological replacement overlaps with regulatory gaps. The mechanism is: generative interfaces encourage treating keys as part of prompts, billing systems deduct resources by the second, and dispute systems verify based on post-event evidence chains. Attack and defense drills check ports and policies but cannot prevent dialogue boxes. Pricing power lies with cloud platforms that can automatically quarantine leaks and issue credit notes, not with individuals who consider themselves compliant in personal operations.
ABAB News · Cognitive Laws
Access keys are more like cash than passwords.
Dialogue boxes are a new type of clipboard; keys should not be part of prompts.
Cloud bills are calculated by the minute, while disputes are resolved based on evidence chains.