Lesson 1.23: Access keys and leaked secrets
Long-term access keys are passwords for programs: whoever has the key ID and secret can call the cloud API as that identity, from anywhere, with no MFA. They leak in code repositories, config files, container images and chat messages, and attackers scan public repositories for them within minutes. In the lab you check the age of the CI pipeline's keys, find one committed to an example file in the API repository, see that it was used the night before, deactivate it safely, and learn why roles and a secrets manager are the real fix.
16 min
You will learn to
- Explain long-term access keys and their risk
- Check key age and last use
- Find keys committed to code
- Deactivate a key safely
- Explain roles, rotation and secrets managers
Key terms
- Access key
- A long-term credential pair (key ID and secret) for programmatic access.
- Key rotation
- Replacing a credential regularly, then deactivating and deleting the old one.
- Secret scanning
- Automatically searching code, commits and images for credentials.
- Secrets manager
- A service that stores secrets, controls access to them and can rotate them.
- Workload identity
- Giving a server, function or pod a role with short-lived credentials instead of stored keys.
← Time, time zones and timelines · All lessons · Randomness and keys →