Ghost Credentials and Non-Human Identities Expose Cloud Environments to Attack

Dormant service accounts, unrotated API keys, and forgotten execution roles continue to quietly undermine cloud infrastructure security. Security researcher Aleksandr Krasnov recently highlighted how this non-human identity sprawl creates critical security blind spots, releasing an open-source tool named NHI Hound to help security teams discover hidden trust paths and ghost credentials in cloud environments.

The Mechanics of Non-Human Identity Sprawl

Non-human identities (NHIs)—which encompass service accounts, serverless execution roles, OAuth tokens, and CI/CD access keys—outnumber human users in modern cloud tenants by a wide margin. While human accounts are typically protected by single sign-on (SSO), multi-factor authentication (MFA), and standard offboarding processes, non-human credentials are frequently provisioned during automated deployments and left unmonitored.

When cloud workloads are decommissioned or deployment pipelines change, the associated access keys and permissions often remain active. These “ghost credentials” retain their original rights, creating persistent backdoors. Attackers who gain initial access to an environment can audit trust relationships across these orphaned accounts, chaining permissions together to move laterally and escalate privileges across cloud platforms without triggering standard user-behavior alerts.

Mapping Cloud Risk with NHI Hound

To address the visibility gap around non-human identities, Krasnov developed NHI Hound. The tool automates the process of auditing cloud environment configurations to locate dormant credentials and chart complex trust paths.

By analyzing cross-account trust policies, role-assumption chains, and actual identity usage telemetry, the utility allows security teams to visualize how an attacker could leverage forgotten service roles to bypass perimeter controls and elevate access across infrastructure boundaries.

Blast Radius and Mitigation

The blast radius of an unmanaged non-human identity compromise is substantial. Because service accounts are routinely granted broad permissions to prevent deployment errors, a compromised ghost credential can provide direct access to sensitive data repositories, source code repositories, or production cloud management planes.

Organizations should replace long-lived access keys with short-lived session credentials using OpenID Connect (OIDC) federation for build systems, enforce automated key rotation, and regularly run identity discovery tools like NHI Hound to eliminate unused IAM roles and trust relationships.