Periodically review and rotate static credentials
Static credentials are credentials that remain valid until they are manually deleted. Examples include AccessKeys for Resource Access Management (RAM) users or an Alibaba Cloud account, database usernames and passwords, and API keys for large language models. The improper use of static credentials can introduce significant security risks. You can effectively reduce these risks by periodically reviewing and rotating static credentials.
Priority
High
Discouraged practices
Failing to audit the usage of static credentials.
Using static credentials for a long time without rotation.
Implementation guide
Periodically review static credentials. Focus on the following aspects of static credential usage:
Abnormal calls, such as many failed calls or calls from untrusted IP addresses. In these cases, the static credentials might be compromised. You can analyze the call logs to investigate further. If you suspect a leak, take immediate action, such as rotating the credentials.
Multiple workloads or environments share a single static credential. This violates the principle of single responsibility. For more information, see Assign different credentials to different workloads and environments.
Credentials with excessive permissions. To follow the principle of least privilege, reduce permissions by deleting those that are unused.
Idle static credentials that have not been used for a long time. You should disable or delete these idle credentials as needed.
For AccessKeys, which are a type of static credential, you can perform risk detection as follows:
Use Cloud Governance Center to inspect configurations. For example, you can check for idle AccessKeys or AccessKeys that have not been rotated for a long time.
Use Security Center to detect exposed AccessKeys in public source code on GitHub. Security Center provides real-time detection of AccessKey information in public source code on GitHub. This code is often uploaded by company employees for private use but is accidentally made public. If an AccessKey leak is detected, Security Center sends you a notification to help you promptly address the exposure risk.
Continuously detect abnormal AccessKey calls.
Configure anomaly alerts in ActionTrail. The ActionTrail service provides built-in alerts that you can enable in the ActionTrail console. This ensures you receive notifications when abnormal AccessKey calls occur. For more information, see Set event alerting.
Detect abnormal AccessKey calls based on historical behavior. The Insights events feature of ActionTrail analyzes historical behavior to identify AccessKeys with abnormal call rates. This helps you promptly detect unusual behavior. For more information, see Overview of Insights events.
If you find that your AccessKey is at risk of exposure or has already been exposed, take immediate action. For more information about risk detection and emergency response measures, see AccessKey Risk Detection and Leak Response Plan.
Periodically rotate static credentials. You should rotate static credentials every six months to a year. If you have implemented the best practice Centrally manage static credentials, credential rotation is seamless for users. You can then shorten the rotation period to 7 to 90 days. Credential rotation ensures that if a credential is unintentionally exposed, the window of exposure is minimized. On the cloud, you can use Key Management Service (KMS) to centrally manage static credentials. KMS provides a productized method to automatically and periodically rotate static credentials. For more information, see Overview of Secrets Manager.
For AccessKeys, you should use Security Token Service (STS) tokens instead of AccessKeys whenever possible. For more information about this best practice, see Use temporary credentials instead of static credentials. For scenarios where you must use AccessKeys, see Centrally Manage Static AccessKeys with KMS to learn how to securely store and use them.