AI Cloud Provider Stops Long-Lived Credentials for Humans and AI Agents
A one-person cloud security team at an AI cloud provider used Native to turn its security baseline into preventive guardrails across 13 cloud environments, starting with long-lived credentials for every human, workload and AI agent identity.
Challenge
The company's cloud security function is one engineer covering 13 cloud environments, each with its own deployment pipelines. Enforcing even a single guardrail by hand, like blocking public storage buckets, wasn't feasible across that estate. A cloud security posture management (CSPM) tool gave the team visibility and metrics, but finding problems creates ticket queues and doesn't stop the next one from being created. As AI speeds up both attacks and the actions automated systems take, preventive controls became urgent.
The first priority was static cloud credentials. The company had thousands of long-lived keys that worked for whoever held them, mostly automation and AI agents. Acquisitions added to the risk: each new company arrives with its own cloud environments and security practices, and the risk team needed to see where each one stood against the corporate standard from day one.
Solution
Blocking static credentials sounds like one rule, but each cloud issues them in several forms, each governed by a different provider-native control. Native's Security Intent Translation mapped the company's single requirement to every credential type and the control that enforces it. On AWS, that meant a service control policy covering IAM user access keys and the other static credential types AWS issues, such as service-specific credentials and signing certificates, enforced across the company's AWS organizations so the request fails no matter which identity makes it.
Before each guardrail was enforced, Native's Impact Simulation replayed real activity from AWS CloudTrail and showed which identities and pipelines would be affected, so owners could move to short-lived credentials first. After rollout, every blocked request shows the identity that made it and goes to the team that owns that identity. When a legitimate action triggers a denial, Native's Exception Management records the owner and the business reason. Newly acquired environments connect to Native from day one and are tracked against the company's baseline.
Static credentials were the first of more than ten guardrails built with the company's risk team. The rest keep storage, databases and Kubernetes control planes off the public internet by default, block cross-identity impersonation and cross-tenant federation, prevent transfers to unapproved external accounts, and keep audit logging and the guardrails themselves from being disabled or changed without review.
AWS services: AWS Organizations (SCPs), AWS IAM, AWS CloudTrail.
Results and Outcomes
- 1,258 expired credentials blocked, against a target of 250, measured through Native's access pattern identification.
- Agentic static-credential creation attempts blocked every month (target: 100 a month), measured through Native's blocked-action view.
- Dozens more preventive guardrails in place since, prioritized from the company's existing CNAPP findings, with controls on AI model use and inference against sensitive data planned next.
- In production since June 2026.