Comment by gz09
9 hours ago
> A human, you can hold accountable, and you can keep them at a good security posture with short-lived session tokens.
You can do this too (and better) with a repo: OIDC/Workload identity trust relationship between github and aws for short lived tokens + a github environment setup that requires manual approval. Bonus: It also gives you an audit trail with a github action log as opposed to a sysadmin running something on a laptop.
The problem here was mostly that they (for some reason) happened to use (and leak) a PAT.
This is the way. And the benefit that still makes it more worth it today, is the fact that you can have truly self-service and peer reviewed infra provisioning and don't depend on a single sys admin or several of them colliding on their machines.
The audit log for the sysadmin is in Cloudtrail, so nothing is lost there.