Long-lived access keys are the COBOL of cloud authentication — they predate the tools that replaced them and survive on inertia. Here’s why the next five years end them, and what’s arriving in their place.
Granted is best-in-class for AWS SSO role switching and browser-console isolation. credctl replaces long-lived keys with hardware-bound OIDC federation. They address overlapping but distinct pain points.
Vault is a centralised secrets manager for teams and services. credctl replaces the long-lived AWS keys on your laptop with hardware-bound credentials. They solve different problems — and often work well together.
aws-vault keeps your long-lived AWS keys encrypted in the OS keychain and hands out short-lived STS sessions. credctl replaces the long-lived keys entirely with hardware-bound OIDC federation. Here’s an honest comparison.
One OAuth token at a third-party AI vendor turned into ‘rotate all your secrets’ for a subset of Vercel customers. The blast radius wasn’t an accident of this breach — it’s the default for extractable, long-lived credentials.
credctl auth –provider gcp exchanges the same hardware-bound JWT for short-lived GCP access tokens via Workload Identity Federation. Same Secure Enclave key. Same OIDC provider. No new infrastructure.
86% of breaches involve stolen credentials. Your AWS keys sit in plaintext on disk. The Secure Enclave can fix this — credctl connects the pieces.
