Avoiding Credential Chaos: Authenticating With No Secrets

The talk starts from a typical company where staff use passwords, engineers use SSH keys, CI pipelines hold cloud keys, and services share static API tokens and pre-shared secrets. The speakers argue that each of these is a liability and that the goal is to remove as many static credentials as possible, and to rotate any that must remain as part of routine deployments. They work through four areas: passkeys replacing passwords for staff logins, short-lived cloud roles with session-based shell access instead of long-lived SSH keys, GitHub acting as an OIDC identity provider so workflows need no stored cloud credentials, and short-lived access tokens issued by an identity provider in place of a fixed API token.

For service-to-service traffic, they cover mutual TLS with a root certificate authority held in an HSM, and a lighter option that wraps a pre-shared key in an encrypted token so the key never crosses the wire. The middle of the session is a live demo of cross-cloud access from Azure to AWS. Trust broke because the Kubernetes cluster issuer ID changed on redeployment, and a wrong role annotation and an incorrect issuer URL format caused further failures. The speakers fixed these in Terraform and Kubernetes manifests, and used a stable Cognito issuer so trust no longer depends on each cluster's identity.

The takeaways are to avoid static secrets where possible, to protect and rotate the ones that must stay, and to treat rotation as everyday operations rather than an incident response task. The final fix was still being built when the session closed.