Lab 3 · Exposed Secrets
Use DAC to find secrets in S3 objects and DB tables, then remediate.
Scenario tie-in
Devs pasted AWS keys, GitHub/Stripe tokens, and DB connection strings into config backups and a 'credentials' table.
3.1 Overexposed Secrets KRI
- On Dashboards → IaaS, read the Overexposed Secrets KRI and click through.
3.2 Hunt secrets
- Investigation: search credentials/keys (look for private key).
- Data Stores: RDS credentials column → Compliance tab.
3.3 Remediate (console, DAC-guided)
- Exposed AWS key: deactivate + delete, rotate.
- App tokens: revoke, move to Secrets Manager.
- Remove the secret; complete Lab 2 if it was public.
Done when
You can name the exposed secrets, where they live, and the fix for each — and removed/rotated one.