Description

Ensure the organization's maximum validity period for new Atlas Administration API service account secrets is set to 8 hours, which is the lowest value Atlas allows. Service account secrets created after the change then expire within 8 hours and must be rotated automatically by the tools that use them.

Rationale

A service account secret works like a password for programmatic access to Atlas. Long-lived secrets are often stored in scripts and CI systems, where they can leak and stay usable for months. Limiting new secrets to 8 hours means a leaked secret quickly stops working, which greatly reduces the window for misuse.

Impact

  • Leaked service account secrets expire within 8 hours

  • Tools must rotate secrets automatically

  • Applies only to new secrets; existing secrets keep their expiry

Default Value

The maximum validity can be set between 8 and 8760 hours (one year). New service account secrets are often created with long expiry periods.

Pre-Requisites

  • Organization Owner role

  • An API key or service account with the Organization Owner role to call the Atlas Administration API

  • Automation able to create and rotate service account secrets every few hours

Test Plan

  1. This setting is managed through the Atlas Administration API (or the AtlasOrgSettings resource of the Atlas Kubernetes Operator).

  2. Run GET /api/atlas/v2/orgs/{orgId}/settings with an API key or service account that has at least the Organization Member role.

  3. Check the value of maxServiceAccountSecretValidityInHours.

  4. If the value is missing or greater than 8, follow the implementation steps.

Implementation Steps

  1. Make sure every tool that uses an Atlas service account can rotate its secret automatically.

  2. Run PATCH /api/atlas/v2/orgs/{orgId}/settings with the body {"maxServiceAccountSecretValidityInHours": 8}, using an API key or service account with the Organization Owner role.

  3. Run GET /api/atlas/v2/orgs/{orgId}/settings to confirm the new value.

  4. When creating new service accounts in the UI (Applications under IDENTITY & ACCESS, then Add new > Service Account), the Client Secret Expiration menu will be limited to this maximum.

Backout Plan

  1. Run PATCH /api/atlas/v2/orgs/{orgId}/settings with a higher value for maxServiceAccountSecretValidityInHours (up to 8760).

Reference