Comparison
Privilege creepvsService account
Privilege creep
the role was widened during an incident three years ago and nothing has ever narrowed it again.
The one-way accumulation of permissions over time, because granting is urgent and revoking never is. It is why the average production role bears no resemblance to what the workload uses, and why access reviews find identities with permissions for systems that no longer exist. The practical counter is data rather than diligence: most clouds report which permissions an identity has actually used, and the unused ones are the list.
Full entry →Service account
the thing calling the API is not a person, and its permissions were granted once in 2022 by someone who has left.
An identity belonging to software rather than a human, used for automated access. They outnumber human accounts by a wide margin, they accumulate permissions because nothing prompts a review, and they rarely have an owner. Every serious cloud compromise story features one, which is why inventorying them and attaching an expiry or a review to each is worth the tedium.
Full entry →