Long-Lived Access Keys

What Is Long-Lived Access Keys?

A static access key never expires, and that single property is the vulnerability. Nobody watches a credential that has worked fine for a year, and the key wired into a build pipeline tends to be the one that leaks. You'll take a key out of a public build log, confirm it still authenticates months later, and read a production database secret. Revocation alone is not the fix: a broken pipeline gets a replacement key restored, so you'll write the trust policy that federates short-lived credentials per run.

What You'll Learn in Long-Lived Access Keys

• A static key has no expiry, so the window between exposure and abuse is bounded only by someone noticing.
• The key wired into a pipeline is the one that leaks, and it usually outlives the person who created it.
• Federation issues short-lived credentials per run, so there is no durable secret to steal.
• Rotation is two moves: revoke the exposed credential and issue a working replacement. A revoke alone breaks the pipeline and gets reverted.

Long-Lived Access Keys — Training Steps

1. A key someone published by accident

   Bob does not break into companies. He collects credentials that companies have already published by accident, and tries them later, because most of them still work. Marnvex runs clinical-trial data platforms for pharmaceutical sponsors. Its build system publishes console logs, and Bob reads them.

2. Wire it into a profile

   A key is only useful once it is wired into a client. Bob puts the pair into a named local profile, the same way any engineer configures a second account.

3. Does it still work

   The first question is whether the key even authenticates any more. He asks the simplest thing there is.

4. What it unlocks

   A CI identity is not glamorous, but it exists to deploy, which means it can read what the application needs to run. Bob asks it for the production database's stored credentials.

5. Why time was the vulnerability

   Bob has production database credentials from a key that leaked a season ago.

6. API calls from nowhere we know

   Marnvex's monitoring flags the CI user making calls from an address it has never seen.

7. Find the key

   The place to start is the key itself: how old it is, when it was last used, and whether it ever had an expiry.

8. How long it has been alive

   The CI key is the flagged one.

9. No expiry, 241 days old

   The key's own record explains why the spring leak is still an incident in the autumn.

10. Kill it

    Containment comes first. Revoking the key stops Bob mid-incident, and it will briefly break CI, which is the correct trade against a live compromise. The replacement comes next.