What happened

Cloud developer platform Railway has warned customers to rotate their secrets after a potential breach. An attacker obtained credentials from Railway's CI pipeline and used them to decrypt secrets that customers had stored on the platform. Up to 100,000 workspaces may be affected.

Why it matters

Stored secrets are often the keys to everything else: database passwords, payment API keys and AWS access keys. If those secrets leak through a provider, attackers can walk into your cloud accounts without ever touching your own code.

How to protect your AWS environment

• Rotate any AWS keys or tokens stored on third-party platforms now, then on a regular schedule.
• Prefer short-lived credentials, such as IAM roles and OIDC federation, over long-lived access keys.
• Alert on any use of your credentials from unexpected IP ranges or regions.

Source: Click to Read the original report (BleepingComputer)

‍