Detecting shared credentials starts with identifying distinct workloads behind one credential. Deciding whether sharing is unauthorized requires the owner's access policy and deployment context. A service account used by several approved jobs should not be treated like a stolen personal key.
Establish the expected sharing model #
Record whether the credential belongs to a person, team, service, or gateway. Identify the approved workloads, expected deployment regions, responsible owner, and permitted downstream delegation. If nobody can describe those boundaries, the immediate problem is missing ownership evidence.
Separate an upstream provider key from downstream gateway keys. Ten downstream customers behind one upstream key may be normal architecture. The same pattern on a credential issued to a single workstation may justify a closer review.
Compare workload populations, not just IP counts #
| Observation | Useful follow-up | What can mislead you |
|---|---|---|
| Simultaneous activity from new and established networks | Identify which deployments produced each group | Multi-region services and failover |
| Different model choices or request timing | Match activity to job schedules and release records | Several approved tasks using one service key |
| Activity after an owner says a workload stopped | Check forgotten jobs, revocation records, and trace IDs | Queued work and retries |
| A new downstream identifier | Check where it was asserted and who could change it | A client-supplied label is not authenticated identity |
Run a sharing investigation #
- Select a review period and a comparable baseline that includes the normal job schedule.
- Group by the strongest available workload identifier. Use network and timing as supporting dimensions, not proof of identity.
- Measure each group's request count, token use, models, and recorded cost. State how much traffic lacks an identifier.
- Ask the owner to reconcile unfamiliar groups to approved jobs or users.
- Assign a case outcome: explained sharing, confirmed unauthorized use with corroboration, or unresolved.
A shared-key example #
Synthetic example: one key serves an interactive application and a nightly evaluation job. The evaluation begins using a second region and a different model. A detector based on new network plus changed model would flag it. The deployment record and job traces explain the activity, so the case should close as authorized sharing. The useful improvement is separate workload credentials, not a recurring exemption for every new network.
Reduce ambiguity without breaking legitimate use #
Where practical, issue credentials per workload, define their scope, and make ownership changes auditable. Use planned rotation with a check for dependent jobs. If compromise is confirmed, contain it promptly using the incident procedure rather than waiting for perfect attribution.
Measure the fraction of cases the owner can resolve and the time to resolution. Count legitimate shared-service alerts separately from unknown cases. Do not call a large number of unresolved alerts a high detection rate.
Continue with gateway attribution records, API-key abuse investigation, and authorization decisions.