Long-Lived Access Keys
A static key has no expiry, so its blast radius is measured in years. Watch one replayed months after it leaked, then revoke it, move the pipeline to short-lived federated credentials, and confirm the old key is dead.
What Is Long-Lived Access Keys?
A static access key has no expiry, so its blast radius is measured in years. The one wired into a pipeline is the one that leaks, and it is still valid long after the person who created it has forgotten it exists. This exercise follows a key from exposure to replay months later, then does the full remediation: revoke it, move the pipeline to short-lived federated credentials, and prove the old key is dead.
What You'll Learn in Long-Lived Access Keys
- A static key has no expiry, so the window between exposure and abuse is bounded only by someone noticing.
- The key wired into a pipeline is the one that leaks, and it usually outlives the person who created it.
- Federation issues short-lived credentials per run, so there is no durable secret to steal.
- Rotation is two moves: revoke the exposed credential and issue a working replacement. A revoke alone breaks the pipeline and gets reverted.
Long-Lived Access Keys — Training Steps
-
A key someone published by accident
Bob does not break into companies. He collects credentials that companies have already published by accident, and tries them later, because most of them still work. Marnvex runs clinical-trial data platforms for pharmaceutical sponsors. Its build system publishes console logs, and Bob reads them.
-
Wire it into a profile
A key is only useful once it is wired into a client. Bob puts the pair into a named local profile, the same way any engineer configures a second account.
-
Does it still work
The first question is whether the key even authenticates any more. He asks the simplest thing there is.
-
What it unlocks
A CI identity is not glamorous, but it exists to deploy, which means it can read what the application needs to run. Bob asks it for the production database's stored credentials.
-
Why time was the vulnerability
Bob has production database credentials from a key that leaked a season ago.
-
API calls from nowhere we know
Marnvex's monitoring flags the CI user making calls from an address it has never seen.
-
Find the key
The place to start is the key itself: how old it is, when it was last used, and whether it ever had an expiry.
-
How long it has been alive
The CI key is the flagged one.
-
No expiry, 241 days old
The key's own record explains why the spring leak is still an incident in the autumn.
-
Kill it
Containment comes first. Revoking the key stops Bob mid-incident, and it will briefly break CI, which is the correct trade against a live compromise. The replacement comes next.