What it means
Cloud credential exposure paths include source code, build systems, images, logs, metadata services, environment variables, local files, browser sessions, and overprivileged automation.
Why it matters
Cloud credentials can provide immediate remote access to control-plane and data-plane resources, often without compromising a traditional endpoint first.
Practical focus
- Inventory human and workload credential locations
- Prefer short-lived, scoped credentials
- Scan code and artifacts for secrets
- Revoke and investigate exposed credentials promptly
Common mistakes
- Rotating a key without reviewing its use
- Treating a private repository as a secret store
- Ignoring tokens and federated sessions
- Keeping long-lived automation credentials
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: