Working as Intended - The Unauditable, Unmanageable Keys in Google Cloud
This blog outlines three vulnerabilities with user-associated HMAC keys in Google Cloud.
Vulnerability #1 - Insufficient Logging
Vulnerability #2 - Unmanagable Long-Term Credentials
Vulnerability #3 - Unauditable Long-Term Credentials
TLDR;
* HMAC keys serve a practical purpose. They can be used to create Sigv4 signed headers used to authenticate against the