Programmatic access.
WHAT THEY ARE
Credentials allowing software to use cloud services.
WHY THEY MATTER
They are passwords, with the permissions attached to them.
WHAT TO DO
Create separate credentials for each purpose Grant the minimum permissions required Rotate them periodically Remove those no longer used
WHAT NEVER TO DO
Place them in code Commit them to a repository Share them between people or systems Use an administrator's credentials for automation
THE REPOSITORY POINT
Keys committed to public repositories are found within minutes by automated scanning.
That is a leading cause of expensive cloud compromise.
WHERE TO STORE THEM
A secrets manager, or environment configuration outside the code.
WHAT TO DO IF ONE IS EXPOSED
Revoke it immediately Create a replacement Review what was done with it Check billing
WHAT TO MONITOR
Use of each credential.
WHAT TO RECORD
Which exist, what each is for, and who owns it.
