Processing secrets that have become publicly available

Yandex Cloud automatically searches for publicly available secrets. If a secret is exposed publicly, the organization owner or user indicated as the Identity and Access Management notification recipient in the organization settings will get an email from the Yandex Cloud support address. To keep your data and infrastructure secure, carefully monitor how your secrets are used.

If your secrets are compromised:

1. Revoke and reissue the secrets.
2. Check for any unauthorized actions.
3. Delete unauthorized resources.
4. Contact support.
5. Follow our recommendations on building a secure infrastructure.

Revoke and reissue the secretsRevoke and reissue the secrets

IAM tokenIAM token

To prevent an intruder from using your token:

1. Revoke the compromised IAM token.

2. Create a new IAM token.

   • For a Yandex account.
   • For a service account.
   • For a federated account.

OAuth tokenOAuth token

You can revoke an OAuth token. In this case, the IAM tokens obtained using the OAuth token will remain valid. Therefore, make sure to revoke all such IAM tokens as well.

To prevent an intruder from using your token:

1. Revoke the OAuth token. Do it by revoking access from the Yandex Cloud application.
2. Revoke all IAM tokens obtained using the compromised OAuth token.
3. Get a new OAuth token.

Authorized keyAuthorized key

If you need to prevent threats posed by a compromised key as quickly as possible, delete the service account.

If you prioritize keeping the process that uses the service account running, reissue the authorized keys:

1. Create a new authorized key for the service account.
2. Provide the new authorized key to the services and users that need it.
3. Get an IAM token for the new authorized key.
4. Delete the old authorized key.

Once you delete the authorized key, the respective IAM token becomes invalid. That is enough to prevent any threat from the compromised key.

JWTJWT

Follow the steps described in the Authorized key section.

Static keyStatic key

1. Create a new static key for the service account.
2. Provide the new static key to the services and users that need it.
3. Delete the old static key.

API keyAPI key

1. Create a new API key for the service account.
2. Provide the new API key to the services and users that need it.
3. Delete the old API key.

SmartCaptcha server keySmartCaptcha server key

Create a new CAPTCHA and, on the website page, replace the old CAPTCHA, whose server key was compromised, with the new one.

CookieCookie

Disable cookies:

1. Change your Yandex ID password.
2. Log in to Yandex ID with your new password.

Check for any unauthorized actionsCheck for any unauthorized actions

Analyze access to your Yandex Cloud resources:

1. Analyze log records in Cloud Logging.
2. Search for events in a bucket or log group in Audit Trails.
3. Make sure that all events, including those related to secret leaks, match your expectations.

Delete unauthorized resourcesDelete unauthorized resources

1. Check Yandex Cloud for any resources that you did not create, such as VMs, data storages, databases, functions, API gateways, and so on.
2. Delete unauthorized resources.

Contact supportContact support

Report the incident to the support. This will help us enhance secret protection in future Yandex Cloud releases.

You can learn more about the support terms here.

Follow our recommendations on building a secure infrastructureFollow our recommendations on building a secure infrastructure

1. Make sure to separate secrets from the source code. This will prevent adding them to public repositories, such as GitHub, along with the code and making them vulnerable.
2. Manage secrets in your cloud.
3. Collect, monitor, and analyze audit logs.