Cloud Secrets Management Failure

HighCloud SecurityOWASP Secrets Management

Cloud environments with secrets stored in plaintext environment variables, hardcoded in code, or managed without proper rotation and access controls expose credentials to unauthorized access and exfiltration.

Immediate Response

1Revoke and rotate all exposed secrets immediately.
2Remove hardcoded secrets from source code and container images.
3Audit secrets manager access logs to identify unauthorized access.
4Assess the impact of exposed credentials and notify affected services.

All playbooks

1Migrate all secrets to a managed vault (AWS Secrets Manager, Azure Key Vault, GCP Secret Manager).
2Implement dynamic secrets with short TTLs and automatic rotation.
3Enable secrets manager access logging and alerting for suspicious access.
4Deploy pre-commit hooks and CI/CD scanning to prevent secret commits.

Long-term Prevention

1Implement workload identity federation to eliminate static credentials where possible.
2Use service mesh for mTLS and secure service-to-service communication.
3Conduct regular secrets audits and remove unused or orphaned credentials.
4Implement automated secret rotation with zero-downtime deployment strategies.

Attack vectors

API keys and database credentials stored in plaintext environment variables
Secrets hardcoded in source code, configuration files, or container images
Cloud vault secrets without rotation policies or access logging
Secrets accessible to all services or containers without least-privilege restrictions

Indicators of compromise

Secret scanning tools detecting hardcoded secrets in repositories or container images
Cloud audit logs showing unauthorized access to secrets manager or vault
Environment variables containing plaintext credentials in container inspection
Unexpected API calls using compromised or leaked credentials

Tooling

AWS Secrets ManagerAzure Key VaultGCP Secret ManagerHashiCorp VaultSOPS