[yogo]

I'm not even sure this should be filed under vulnerability. How is this any different from embedding credentials on a webpage so that JavaScript can talk directly with the service lol.

[samstave]

It is a vulnerability in your environment if you're using some of these tools and your keys are in them. It is not a vulnerability of AWS itself.