Description

Ensure every OVHcloud API credential (application key, application secret, and consumer key) is created with a limited validity period instead of an unlimited one. Long-running automation should use credentials that are renewed on a schedule.

Rationale

API credentials give programmatic access to the account with the rights they were granted. Credentials without an expiry stay valid forever, even after the script or person using them is gone, and are often forgotten in code, CI systems, or laptops. A limited validity makes sure leaked or forgotten credentials stop working on their own.

Impact

  • Leaked or forgotten credentials stop working automatically

  • Encourages regular review of API access

  • Automation must renew its credentials before they expire

Default Value

When creating API keys, you choose the Validity, and an unlimited validity can be selected.

Pre-Requisites

  • Access to the OVHcloud account

  • A list of tools that use OVHcloud API credentials

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select API keys.

  4. Review each API key and its expiration date.

  5. Alternatively, use the OVHcloud API console at https://eu.api.ovh.com/console/ (or your region's console). Run GET /me/api/credential, then GET /me/api/credential/{credentialId} for each ID, and check the expiration field.

  6. If any credential has no expiration date, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select API keys.

  4. Select Create API key, enter a name and description, choose a limited Validity period, and set only the Rights the tool needs.

  5. Update the tool to use the new application key, application secret, and consumer key.

  6. Delete the old credential from the ⋯ menu, or run DELETE /me/api/credential/{credentialId} in the API console.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select API keys.

  4. If a tool stops working, create a new API key for it and update the tool.

Reference