Description

Ensure OVHcloud API credentials that are no longer used by any script, tool, or integration are revoked. The account's credential list should contain only credentials that are actively in use and have a known owner.

Rationale

Unused credentials still work until they expire or are deleted, and they are easy to forget in old repositories, laptops, or CI systems. If one leaks, an attacker can use it without anyone noticing. Revoking unused credentials reduces the number of keys that could be abused against the account.

Impact

  • Removes forgotten credentials that could be abused

  • Keeps the credential list easy to review

  • Any tool still using a revoked credential stops working

Default Value

By default, OVHcloud does not revoke unused credentials automatically.

Pre-Requisites

  • Access to the OVHcloud account

  • A list of tools that use each credential

Test Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select API keys.

  4. Review the list of API keys and identify keys that are not linked to an active tool.

  5. Alternatively, use the OVHcloud API console at https://eu.api.ovh.com/console/ (or your region's console). Run GET /me/api/credential/{credentialId} for each credential and check the lastUse field.

  6. If any credential has not been used recently or has no known owner, follow the implementation steps.

Implementation Steps

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select API keys.

  4. Confirm that no tool depends on the unused credential.

  5. Open the ⋯ menu for the key and delete it, or run DELETE /me/api/credential/{credentialId} in the API console.

Backout Plan

  1. Log in to the OVHcloud Control Panel at https://www.ovh.com/manager/.

  2. In the left-hand menu, select Identity, Security & Operations.

  3. Select API keys.

  4. Create a new API key with limited rights and a validity period, and update the tool that needs it.

Reference