The New Stack: What happens when the agent is long gone, but its access key lives on?
The article argues that access keys created for agents or deployments persist after their tasks end, since AWS IAM user access keys do not expire automatically. It provides a CloudQuery SQL query to list active IAM keys older than 90 days and unused for 90 days, and an env zero OPA policy that denies creation of selected long-lived credential types in Terraform and OpenTofu plans. It also notes that TTL-driven teardown does not guarantee revocation and shows AWS CLI commands to deactivate a specific key.
What changes for platform teams
Platform teams running agent or deployment pipelines can use the inventory query and deploy-time policy to find and block long-lived keys, but must still verify revocation separately, since TTL destroys and policies do not cover credentials created outside managed deployments.
Read the original at The New Stack ↗
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules