How to Find Leaked AWS Keys in Your Own Code

Your site's JavaScript is public, and so is every repo you push. That means a stray AWS access key can sit there for months with nobody noticing.

Two grep one-liners will tell you in seconds whether a key ID is hiding in your own pages or your public repos. Long-term keys and temporary ones show up the exact same way.

What You Need

• A site or repository you own or have permission to scan.
• curl and grep on your machine, plus git for the repo check.

Tutorial

1. Scan your live site's JavaScript for key IDs.

curl -s TARGET | grep -oP 'https?://[^"]+\.js' | xargs -I{} curl -s {} | grep -oP '\bA[KS]IA[0-9A-Z]{16}\b'

Swap TARGET for your own URL. The first grep pulls every script address out of the page, then the second checks each one.

1. Clone a public repo shallowly and grep it for the same pattern.

git clone --depth=1 TARGET/repo.git /tmp/r && grep -rP '\bA[KS]IA[0-9A-Z]{16}\b' /tmp/r

Replace TARGET/repo.git with your repo's address. The --depth=1 flag keeps the download to the latest commit, so it finishes fast.

Wrapping Up

A match means an access key ID is sitting in code anyone can read, and both long-term and temporary keys are easy to leak and easy to abuse. Treat any hit as already compromised and rotate that key rather than just deleting the line. Run the two commands again after a big merge or a deploy and you will catch the next one early.