AWS access key leaked? Disable it in IAM right now

1. Step 01

   Sign into the AWS Console → IAM → Users → find the user → Security credentials → Make the access key inactive.

2. Step 02

   Create a new access key, update your server env vars, then delete the old one.

3. Step 03

   Open CloudTrail. Look for unfamiliar API calls in the last 24 hours — especially RunInstances, CreateUser, GetCallerIdentity from unknown IPs.

Step 01 — Revoke

Kill the leaked credential first

IAM → Users → click the user that owns the key → Security credentials tab → Access keys section → Actions → Make inactive (faster than delete; reversible while you confirm). Then create a new key and delete the old one.

Step 02 — Rotate

Update the new key in the right place

Server-side env vars only — never in client code, never with NEXT_PUBLIC_.

// Server-side. Never NEXT_PUBLIC_.
import { S3Client } from '@aws-sdk/client-s3';
const s3 = new S3Client({
  region: 'us-east-1',
  credentials: {
    accessKeyId: process.env.AWS_ACCESS_KEY_ID!,
    secretAccessKey: process.env.AWS_SECRET_ACCESS_KEY!,
  },
});

Step 03 — Scan

Confirm nothing else leaked alongside it

Scan your live site for any other cloud credentials still sitting in your bundle.

How this usually leaks

• 01Used directly in a frontend "upload to S3" feature instead of a presigned URL.
• 02Committed in .aws/credentials accidentally added to git.
• 03Stored in a config.json deployed to /public/ folder.
• 04Pasted into a Lambda env var with overly broad IAM permissions, then exposed via a public Lambda URL.