Long Live Short Lived Credentials - Auto-rotating Secrets At Scale

The talk opens by asking how long it takes to rotate every API key and cloud credential, then uses a breach example in which stolen credentials spread across several connected services and forced thousands of keys to be replaced. The speaker cites industry breach reports that name leaked or stolen credentials as a leading root cause, and notes research suggesting machine identities far outnumber human ones in modern environments.

The core advice is to take things one step at a time. Where possible, remove standing credentials altogether, use phishing-resistant MFA for people, and gather every remaining secret into a single secrets manager with encryption and central reporting. Secrets should be prioritized, starting with crown jewels, then legacy secrets, and finally forgotten "zombie" secrets. Discovery relies on scanners such as TruffleHog and Gitleaks, and rotation follows a create, test, swap, and clean-up pattern. The speaker covers cloud-native vaults for single-cloud shops, multi-cloud options, and an open-source workflow that finds exposed secrets and opens pull requests to replace them with vault lookups.

Looking further ahead, the speaker points to short-lived workload identities such as SPIFFE and SPIRE, which issue credentials that expire quickly. In audience questions, legacy systems, databases, and SaaS tools that depend on manual admin consoles were raised as hard to automate, and the speaker suggested business risk should decide how far to go. The main takeaway is to start with one secret at a time.