Context
The near-miss followed a pattern public post-incident reports made painfully familiar through 2024: credentials harvested from a developer endpoint, reused against cloud infrastructure where MFA didn’t exist because “it’s a machine.” The incident response was clean. The uncomfortable question came after: how many other keys like that are live right now?
Nobody could answer it.
Regulatory driver
SOC 2 Type II CC6 logical access criteria, on a five-month clock. Underneath that: PCI DSS 4.0.1 account-management and MFA requirements for the cardholder data environment, and — because the platform was expanding into Canada — OSFI B-13’s expectations for privileged and non-human access, which reach the same credentials from a different direction. One inventory, two evidence views.
What we did
Discovery without blame. We enumerated every IAM user, role, key, and OAuth grant across AWS and GitHub: 1,400 non-human identities, 31% carrying admin-equivalent permissions, 78% of access keys older than 90 days. Ownership mapping found 400+ identities whose creator had left the company.
Triage by blast radius. Admin-scoped and externally-reachable identities went first. Unused roles deleted, wildcard trust policies rewritten, escalation chains (deploy key → workflow → OIDC role) severed at each hop — 31 paths closed in total.
Rotation as infrastructure. Long-lived keys migrated into HashiCorp Vault with dynamic issuance and automated rotation. New policy enforced in CI: static credentials can’t merge.
Result
SOC 2 Type II passed on the first attempt with auditors specifically noting the NHI ownership model. Mean key age across the environment is now measured in days, not years — and the next infostealer harvest will hit credentials that rotate underneath it.