Cremit Research · Incident Response Series
A field playbook for investigating leaked API keys and cloud credentials across AWS, GCP, Azure and the secret stores behind them, and for proving how far they could reach.
It is the set of resources and actions the credential could reach under its current permissions. Possible access is not proof of use: confirm the identity and grants with the issuer, then inspect the activity logs that were available.
34 pages · PDF · EN/KO · Published 2026-09-04 · Web exercise added 2026-10-07
AudienceIncident responders, DevSecOps, platform & cloud security teams
Team exercise · No external requests
Every record below is fictional. No real key or issuer request is needed. Separate what each observation establishes from what remains unknown.
Record masked identifiers and evidence locations instead of raw secrets. Edit the worksheet locally; no upload is required.
This web exercise draws on playbook pages 11–12 (verification and exposure), 25–26 (secret stores and rotation order), and 28–31 (evidence and closure). The exercise is separate from the PDF.
See the response flow in the productStart here · Page 2
The rest of the playbook is reference material for the investigation. Start these three actions in the first five minutes.
Save the exposed location and discovery time in UTC. Collect available logs without delaying deactivation or rotation; those actions do not erase logs already retained by the provider.
A prefix may identify the provider and credential class. Some structured credentials reveal account context, but the owner, validity and permissions usually need issuer-side records.
Honeypot research observed some planted AWS keys used within minutes; that is not a clock for every credential. “No evidence of use” is not an all-clear. Check which relevant logs were enabled.
Most compliance regimes require notification within a fixed time of the moment you become aware, not the moment you understand. Under NIS2 the first filing is due in 24 hours.
Every chapter maps to one phase. The running header tells you where you are.
Our own analysis, not a vendor statement
When AWS finds your key in public it attaches AWSCompromisedKeyQuarantineV3. Diffing the three versions since 2020 shows the deny list growing from 28 to 99 actions, no action ever removed, and beyond S3 reads, not one of the twenty-one data-access actions we checked has ever been denied. sts:AssumeRole and secretsmanager:GetSecretValue still work.
Model discovery as a Poisson process with rate λ; the chance of at least one discovery in a window W is 1 − e^(−λW). Four rates spanning four orders of magnitude disagree sharply for the first hour and agree completely after a month. Toyota was exposed for five years, Microsoft AI for three, Mercedes-Benz for three and a half months, xAI for two. Every one of them sits where all four rates return the same answer.
GCP splits audit logging into two classes with opposite defaults. Admin Activity is always on, free, 400 days. Data Access is off, billable, 30 days. Reading a secret is DATA_READ. Whether GCP Data Access logging is on, whether Key Vault has a diagnostic setting, whether your CloudTrail captures data events: no tool retroactively creates the evidence.
Every factual claim is listed against its primary source in Appendix C, page 32.
Security engineers and CISOs read our monthly brief on Non-Human Identity attacks, controls, and field research.
From playbook to program
The incidents in this report are almost all failures of sustaining, not of knowing. Nothing in the previous thirty-two pages requires a vendor: an inventory, an owner, provider-accurate containment, and a ledger. Cremit Platform exists because those four are difficult to sustain by hand across every repository, bucket and workspace an engineering organisation touches.
Page 33 lists, phase by phase, what the platform does and what stays with your team.
Use this as an internal runbook or as training material, unchanged. Keep the attribution when you lift a table or a figure. If you plan to adapt it, tell us and we will send you an editable original. ben@cremit.io
Optional cookies count visits, identify visiting companies, and measure ads. You can decline. Cookie policy