An experiment by security research firm Truffle Security showed that the average time from a valid AWS key being publicly exposed to its first malicious invocation is no more than 4 minutes.