What happens if cloud access keys leak, for example on GitHub?
Usually something bad, and quickly, because attackers scan public code repositories for keys continuously. A cloud access key or API token works like a password that never asks for multi-factor authentication; whoever has it can use the account with that key's permissions from anywhere. Typical abuse ranges from starting expensive compute for cryptomining, to copying storage buckets and databases, to creating new users so the attacker keeps access after the key is revoked. Leaks happen through code committed to public or shared repositories, configuration files in backups, screenshots, CI logs and chat messages. If it happens: revoke or rotate the key at once, not after the investigation; check the account's activity logs for everything done with it since the leak, including new users, keys and resources in unusual regions; remove what the attacker created; and review billing. To prevent it, use secret scanning in your repositories, short-lived credentials instead of long-lived keys, narrow permissions per key and budget alerts. A network sensor cannot see a key published on the internet; it may see the consequences on servers it watches.