cloud-credential-hygiene

帮你检查云上凭证是怎么发放、存放、分权限和轮换的。适合在审计云账号安全、排查泄露或要把长期有效的 access key 改成短期凭证时用。重点是把长期存在于 repo 或过大权限的密钥找出来，改为短期、最小权限并移出攻击者常看的位置，从根本上减少多数云泄露的起点。

## Purpose

Most cloud compromises don't start with an exploit — they start with a credential. A long-lived access key committed to a repo, an over-scoped key that never expires, a root account with programmatic keys. This skill covers the practices that keep credentials short-lived, tightly scoped, and out of the places attackers look.

## When to use it

Auditing a cloud account's security posture, onboarding a new one, or after any leak scare. It pairs with the S3 and IAM-privesc skills — hygiene is the layer that stops the initial foothold those attacks build on.

## Procedure

1. **Find long-lived static keys and question each one.** IAM users with access keys are the main leak risk. Li