# Cloud IAM and secrets: reduce standing access and prove revocation

Source: https://www.web3sec.news/blog/cloud-iam-secrets-runbook
Updated: 2026-11-08

Assign owners and record supporting evidence in your team's own system.

- [ ] Inventory escalation paths as well as named administrators.
- [ ] Track every secret consumer without copying secret values.
- [ ] Use narrowly trusted temporary identities where supported.
- [ ] Verify old credentials fail after rotation.
- [ ] Test emergency recovery and alert on its use.

## References
- [AWS: IAM security best practices](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html)
- [AWS: Secrets Manager best practices](https://docs.aws.amazon.com/secretsmanager/latest/userguide/best-practices.html)