Rotate and remove stale IAM credentials

IAM users and their credentials are free, so this capability is almost never a line on the invoice. The cost lives entirely on the risk side. A dormant access key from a departed contractor, a weak password on an admin user, or a plain-text key in a build project is a static secret that an attacker can use the moment they find it, and leaked AWS keys are scraped from public repositories within minutes. The remediation, by contrast, is engineering time measured in hours.

Frame each failing control as a line on the risk register weighted by what the credential can reach. A dormant key on a user with broad S3 or admin permissions is a far higher expected loss than one on a read-only log viewer, yet both show up as a single Medium finding. The CodeBuild controls are rated Critical for the same reason: a long-lived key in clear text is a master credential anyone with read access to the project can copy. Prioritise by blast radius, not by finding count.

The insurance maths is one-sided. The documented cost of a credential-based breach, incident response, forensics, regulatory notification and a possible runaway crypto-mining bill, routinely runs into seven figures. The cost of running a credential audit, tightening a password policy and moving a secret into a managed store is essentially zero. This is a control you keep at or near a clean state, not one you optimise for spend.

Priya is the finance partner for the platform team at the same fintech. Security Hub hands her a cluster of credential findings: dozens of IAM.8 and IAM.22 dormant-key flags, a failing IAM.7/IAM.10 password policy, and a single Critical CodeBuild.2 finding for a plain-text key. Her first instinct is not to ask what it costs, because she already knows the answer is roughly nothing in AWS spend. Her question is which of these credentials could turn a leak into a balance-sheet event, and which are noise on the report.

She asks the team to cross-reference each flagged credential against the permissions it actually holds. The dormant key on the read-only log viewer is a low-weight line on her risk register. The never-rotated key on an admin user and the plain-text CodeBuild key are the ones she front-loads, because their misuse is the seven-figure breach scenario with incident response, regulatory notification and a possible runaway crypto-mining bill behind it. Her output for the risk pack is one sentence: the cleanup is near-zero cost, and we prioritise it by blast radius, not by finding count.

The cost model here is asymmetric. Removing a dormant key, tightening a password policy or relocating a secret costs nothing in AWS spend, and leaving them open creates an unbounded tail risk. Each failing credential is a place where a leak becomes account access, and while the probability per credential is low, the probability across all of them over years is not. A leaked admin key can also drive a five- or six-figure crypto-mining bill before detection, and AWS waives fraudulent charges only partly and only when you can show reasonable controls were in place.

There is a compliance-cost dimension too. A failing credential control can turn a smooth SOC 2 or PCI audit into one with a qualification or a remediation plan, which means auditor follow-up hours, management attention, and sometimes a disclosure to customers who gate purchasing on a clean report. The finance role is to prioritise the cleanup by blast radius, front-loading the broad and administrative credentials whose misuse would generate the breach-cost event, and to treat a rising finding count as a leading indicator that offboarding or pipeline hygiene has slipped.

Static credentials accumulate. People leave, pipelines are retired, secrets get pasted into config, and unless someone removes them, they stay valid and unmonitored for years. The report shows this as a scatter of findings across IAM users, build projects and customer pools, but the leadership question behind all of them is one sentence: is access removed and rotated as a matter of process, or only when someone remembers?

The finding count is a proxy for how reliably the organisation manages the credential lifecycle. A high count of dormant credentials means offboarding and credential cleanup are decoupled. A plain-text key in a pipeline usually means there is no enforced no-static-credentials standard. Closing these findings and keeping them closed is evidence of a process that works by design.

Almost none of this is a cost decision. Removing a key, setting a password policy, or moving a secret into a managed store is free in AWS terms. It is a governance decision about whether the credential surface shrinks automatically or grows with every departure and every copy-pasted pipeline.

After a peer in the sector disclosed a breach traced to a years-old access key left by a departed contractor, the CEO asked one question at the next risk review: could that happen to us, and how would we know? The honest answer was that nobody could say, because credential cleanup happened when an engineer remembered it rather than as a step in offboarding. The dormant-credential count on the security report was the visible symptom of that gap.

The leadership response was to treat credential hygiene as a process requirement rather than a backlog of findings. Credential revocation became a mandatory, audited step in offboarding; static keys in pipelines were banned by policy and enforced with a service control policy; human sign-in moved to IAM Identity Center. Six months on, the question changed from could that happen to us to what is our dormant-credential trend, and the answer was a line that stayed low quarter on quarter. That trend, not the point-in-time count, is the signal that belongs on a governance review.

The finding count for this capability measures how reliably the organisation manages the credential lifecycle. A high dormant-credential count means access provisioning and offboarding are not connected. A plain-text key in a pipeline means there is no enforced standard against static credentials. Those are governance gaps, not technical ones, and they predict larger problems in the same blind spot.

The downstream consequences are material: every dormant or embedded credential is a potential unauthorised entry point with full use of whatever permissions were granted, with no monitoring and no one watching the logs. In the incident cases that get the most press coverage, this is exactly the access vector, a credential that existed because nobody took the thirty-second step of removing or rotating it. The cost of getting it wrong is large and well documented; the cost of fixing it is engineering time, which is the trade leadership should be quickest to approve.