What a AWS access key looks like

An access key ID is 20 characters: a four-letter prefix (AKIA for long-term IAM user keys, ASIA for temporary STS credentials) followed by 16 uppercase letters and digits. It is paired with a 40-character secret access key, which is the part that signs requests.

A fake example, in the right format:

AKIAFAKEKEYFORDEMO23

ScrubLogs replaces it with <AWS_KEY_1>.

Why a leak is dangerous

Automated scanners watch public GitHub, paste sites and package registries for AWS keys, and leaked keys are often used within minutes, typically to launch crypto-mining instances billed to your account.

If yours leaked: rotate it

Redacting a copy doesn’t un-leak the original. If the real value was shared anywhere, replace it:

1. In the IAM console, open the user that owns the key and go to Security credentials.
2. Create a new access key and deploy it to every app and pipeline that used the old one.
3. Deactivate the old key, confirm nothing breaks, then delete it.
4. Review CloudTrail for activity from the old key and check billing for unexpected resources in every region.