Long-lived access key

The problem is not the key, it is the absence of an expiry. A temporary credential obtained by assuming a role is useless a few hours after it leaks; a static key works until somebody notices. And they leak through channels that are hard to close: a public repository, a commit history that was rewritten but is still served by a fork, a container image layer, a build log, a mobile application bundle, a state file, a laptop backup.

The replacement is available on every major platform and costs nothing. Workloads running inside the provider take an identity from the platform. Pipelines and workloads running outside use workload identity federation to exchange a short-lived token from their own identity provider for cloud credentials, which removes the stored secret entirely. What remains after that is a small number of genuine exceptions, and those belong in a managed store with rotation, which is the ordinary work of secrets management.

Two things to check that are usually skipped: the last used timestamp, which typically shows that a large share of keys in an estate have never been used at all, and the keys attached to identities that also hold administrative rights. In a report we name the identity, the age of the key, its last use and what it can reach, because that combination is what makes the remediation argument, and it comes from the cloud testing where we go looking for keys before anything else.