Notifications
Clear all
Topic starter
17/08/2026 4:42 pm
TL;DR: Static API keys, SSH keys, and passwords remain the weak point in multi-cloud and microservice environments, according to Akeyless, and secretless authentication plus passwordless access reduces exposure by replacing long-lived credentials with dynamic, short-lived tokens. The bigger issue is that identity governance still assumes credentials persist long enough to be reviewed, rotated, and revoked.
NHIMG editorial — based on content published by Akeyless: managing usernames, passwords, and machine identity with secretless access
Questions worth separating out
Q: How should security teams reduce reliance on static credentials for workloads?
A: Start by identifying which workloads can authenticate with cloud identity, Kubernetes identity, OIDC, certificates, or attestation instead of carrying reusable secrets.
Q: Why do static API keys and SSH keys remain a problem even with MFA?
A: MFA protects the login step, but it does not solve the wider problem of credentials that can be copied, reused, or embedded in automation.
Q: What breaks when organisations manage machine identities like user accounts?
A: The programme loses visibility, ownership, and lifecycle control.
Practitioner guidance
- Inventory every long-lived credential path Identify passwords, API keys, SSH keys, certificates, and tokens used by humans and workloads across cloud, Kubernetes, and remote access flows.
- Separate human and machine access policies Use passwordless and MFA policies for human users, but govern workloads with short-lived credentials, workload identity, and explicit runtime issuance rules.
- Replace embedded secrets with JIT credentials Block hardcoded credentials in pipelines, containers, and configuration files, then issue ephemeral tokens only when the task begins.
What's in the full article
Akeyless' full article covers the operational detail this post intentionally leaves for the source:
- Step-by-step access flows for PostgreSQL, MySQL, Linux, and Kubernetes environments
- Examples of ephemeral token use for services, pods, and remote administrative sessions
- How SPIFFE integration is positioned for workload identity and secret handling
- The article's own breakdown of secretless versus passwordless use cases across human and machine identities
👉 Read Akeyless' analysis of passwordless and secretless identity access →
Static secrets in cloud environments: what IAM teams need to know?
Explore further
View Full Forum → | NHI Foundation Course → | Our Services →
17/08/2026 4:47 pm
Static credential dependence is the root governance failure in this model. Long-lived passwords, API keys, SSH keys, and tokens assume the identity will keep behaving in a stable, reviewable way after access is granted. That assumption fails in cloud, Kubernetes, and microservice estates where the access need is task-bound and transient. The implication is that identity governance must stop treating persistence as normal for machine access.
Static credential debt: the longer a secret survives across cloud, Kubernetes, and remote admin workflows, the more governance effort is required to prove who can still use it. For teams moving toward ephemeral access, the important question is no longer where the secret lives, but whether any business process still depends on its persistence.
A question worth separating out:
Q: What frameworks are most relevant to workload identity governance?
A: OWASP NHI guidance, Zero Trust Architecture, and NIST CSF are the most directly applicable starting points. They help teams align access policy, observability, and lifecycle governance so machine identities are handled as first-class identities rather than as ad hoc technical artefacts.
👉 Read our full editorial: Secretless access and passwordless identity reduce NHI risk
