Cremit Research · Incident Response Series
A field playbook for investigating leaked API keys and cloud credentials across AWS, GCP, Azure and the secret stores behind them, and for proving how far they could reach.
34 pages · PDF · EN/KO · 2026-09-04
AudienceIncident responders, DevSecOps, platform & cloud security teams
Start here · Page 2
Everything past this page is reference material you consult during and after the incident. This page is what you act on in the first five minutes.
Screenshot or export the exposure and record the exact discovery time in UTC. Revocation destroys the evidence that tells you what the key could reach and whether anyone used it.
The prefix and structure already tell you the provider, the credential class, and often the owning account, all of it offline.
A key exposed on the public internet can be exploited within one to five minutes. “We found no evidence of use” is an unfinished investigation, not an all-clear. In two of the three major clouds, secret reads are not even logged by default.
Most compliance regimes require notification within a fixed time of the moment you become aware, not the moment you understand. Under NIS2 the first filing is due in 24 hours.
Every chapter maps to one phase. The running header tells you where you are.
Our own analysis, not a vendor statement
When AWS finds your key in public it attaches AWSCompromisedKeyQuarantineV3. Diffing the three versions since 2020 shows the deny list growing from 28 to 99 actions, no action ever removed, and beyond S3 reads, not one of the twenty-one data-access actions we checked has ever been denied. sts:AssumeRole and secretsmanager:GetSecretValue still work.
Model discovery as a Poisson process with rate λ; the chance of at least one discovery in a window W is 1 − e^(−λW). Four rates spanning four orders of magnitude disagree sharply for the first hour and agree completely after a month. Toyota was exposed for five years, Microsoft AI for three, Mercedes-Benz for three and a half months, xAI for two. Every one of them sits where all four rates return the same answer.
GCP splits audit logging into two classes with opposite defaults. Admin Activity is always on, free, 400 days. Data Access is off, billable, 30 days. Reading a secret is DATA_READ. Whether GCP Data Access logging is on, whether Key Vault has a diagnostic setting, whether your CloudTrail captures data events: no tool retroactively creates the evidence.
Every factual claim is listed against its primary source in Appendix C, page 32.
Security engineers and CISOs read our monthly brief on Non-Human Identity attacks, controls, and field research.
From playbook to program
The incidents in this report are almost all failures of sustaining, not of knowing. Nothing in the previous thirty-two pages requires a vendor: an inventory, an owner, provider-accurate containment, and a ledger. Cremit Platform exists because those four are difficult to sustain by hand across every repository, bucket and workspace an engineering organisation touches.
Page 33 lists, phase by phase, what the platform does and what stays with your team.
Use this as an internal runbook or as training material, unchanged. Keep the attribution when you lift a table or a figure. If you plan to adapt it, tell us and we will send you an editable original. ben@cremit.io
We use cookies to measure traffic and ad performance. Declining costs you nothing: the site keeps working, and all that stays is your language and this answer. Everything we load is listed in the cookie policy