Handling secrets that are available in the public domain
Yandex Cloud automatically scans the public domain for secrets. Keep track of how secrets are used to ensure the safety of your data and infrastructure. If your secrets are compromised:
- Revoke and reissue secrets.
- Check for any unauthorized actions.
- Delete unauthorized resources.
- Contact support.
- Follow our recommendations on building a secure infrastructure.
Revoke and reissue secrets
IAM token
You cannot delete an IAM token. If you create a new IAM token, the previous one remains valid.
To prevent a hacker from using your token:
-
Perform the following actions with the service account the IAM token was issued for:
-
For a service account: reissue the authorized key of the service account that the token is granted for or delete the account.
-
For a Yandex or federated account, do one of the following:
-
Remove the account from all organizations while the token is valid.
-
Revoke the rights of the account in any cloud and organization for the token validity period.
Note
IAM tokens are valid for up to 12 hours.
-
-
-
Create a new IAM token.
OAuth token
You can revoke an OAuth token. In this case, the IAM token that is obtained using the OAuth token remains valid.
To prevent a hacker from using your token:
-
Revoke the rights of the account that the OAuth token belongs to in one of the following ways:
-
Remove the account from all organizations while the IAM token is valid.
-
Revoke the rights of the account in any cloud and organization for the IAM token validity period.
Note
IAM tokens are valid for up to 12 hours. Learn more about the IAM token lifetime.
-
Authorized key
If you need to prevent damage from a compromised key as quickly as possible, delete the service account.
If the continuity of the process that the service account is part of is more important to you, reissue authorized keys:
- Create a new authorized key for the service account.
- Grant the new authorized key to the services and users using it.
- Get an IAM token for the new authorized key.
- Delete the old authorized key.
Once you delete the authorized key, the respective IAM token becomes invalid. That is enough to prevent any threat from the compromised key.
JWT
Follow the steps described in the Authorized key section.
Static key
- Create a new static key for the service account.
- Grant the new static key to the services and users using it.
- Delete the old static key.
API key
- Create a new API key for the service account.
- Grant the new API key to the services and users using it.
- Delete the old API key.
SmartCaptcha server key
Create a new CAPTCHA and, on the website page, replace the old CAPTCHA, whose server key was compromised, with the new one.
Cookies
Disable cookies:
- Change your password
in Yandex ID. - Log in to Yandex ID
with the new password.
Check for any unauthorized actions
Analyze access to your Yandex Cloud resources:
- Analyze log records Cloud Logging.
- Search for events in a bucket and search for events in a log group in Audit Trails.
- Make sure that all events, including those related to secret leakage, are consistent with expectations.
Tip
You can configure exporting audit logs to a SIEM system.
Delete unauthorized resources
- Check that Yandex Cloud does not contain any resources that you have not created, such as a VM, data store, database, function, API gateway, etc.
- Delete unauthorized resources.
Contact support
Report the incident to the support team
You can learn more about the technical support terms here.
Follow our recommendations on building a secure infrastructure
- Make sure secrets are separated from the source code. This will help you avoid adding them to public repositories, such as GitHub, along with the code and making them vulnerable.
- Manage secrets in your cloud.
- Collect, monitor, and analyze audit logs.