Long-Lived Privileged Credentials

What this finding is

Static secrets carrying privileged access — cloud access key pairs, personal access tokens, API keys, service account passwords — exist without an expiry and without a rotation record. The finding covers both the absence of rotation and the wider problem of secrets distributed to locations from which they cannot be recalled: source repositories, CI configuration, container images, and developer workstations.

Why it is Tier 1

A static privileged credential is a permanent skeleton key whose exposure history cannot be reconstructed. Once copied into a repository or a build log it may be replicated indefinitely, and credential-scanning bots harvest public commits within seconds of a push. Because there is no expiry, a credential leaked years ago remains valid today, so the exposure window is unbounded until rotation occurs.

How to detect it

1. 1Report cloud access keys by age and by last-used date; keys that are old and unused are the highest-value targets for removal.
2. 2Run secret scanning across the full history of every repository, not only the current tree — deleted secrets remain in git objects.
3. 3Scan container image layers and CI job logs, both of which persist secrets that were removed from source.
4. 4Correlate each active credential to a named owner and purpose; unattributable credentials should be treated as compromised.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1. 1Rotate the credential before investigating its provenance — the investigation is valuable but the rotation is what closes the exposure.
2. 2Replace static keys with short-lived, federated credentials wherever the platform supports it (OIDC federation for CI, instance or workload identity for compute).
3. 3Move any remaining static secrets into a managed secret store with automatic rotation, and grant retrieval by workload identity rather than by embedded credential.
4. 4Where a secret reached a public repository, treat it as compromised regardless of how briefly it was visible, and review usage logs for the whole window.
5. 5Add pre-commit and pre-receive secret scanning so the next occurrence is blocked before it becomes permanent.

How to verify the fix

Mappings

Other Tier 1 findings in Identity & Access Management