A long-term access key is an AWS IAM credential that stays valid until it is manually revoked or rotated. Unlike temporary session credentials, it does not expire on its own, so anyone who obtains it may keep using it until defenders notice and disable it.
This makes leaked long-term keys especially dangerous in source code, build logs, chat messages, or pasted snippets. Attackers often search for them because a single exposed key can provide direct API access to cloud resources, sometimes with the permissions of a privileged user or service account. Defenders use secret scanning, access monitoring, and automated quarantine controls to limit damage, but containment is not enough: the key should still be revoked, permissions reviewed, and activity checked in logs such as AWS CloudTrail. In practice, a leaked long-term key should be treated as already compromised.