Hacker News Reader

> Following this revelation, we were able to observe that these keys change on an hourly basis...

Is it recommended to rotate keys hourly, or even daily? Or only for something like AWS - I've read/been told monthly is more than adequate for reg. web apps

View on HN

When possible, you should not use IAM user long-term credentials.

Inside AWS, temporary security credentials via STS should be used.

Outside AWS, OIDC federation should be used.

Users should use SSO.

you should provision jit creds via sts - I think default session length if 1hr. dont use hard coded keys and use IRSA.

Reply on news.ycombinator.com