Agent WranglersData and secrets Required
Give each key the least power
Give every key, account and service only the access it needs. Replace keys on a schedule and at once after a leak.
How to do it
Use a separate key for each service and each environment. Let the website's database user read and write its own tables, but not drop them or create users. Write down how to replace each key, and practise it. For more depth, see a service user and a sandbox. Give the server a backup key that can write new backups but never delete them, so an attacker on the server cannot remove them. See off-site backups.
How to check
The agent uses the app's own database account to try a forbidden action, such as creating a table. The database refuses it.
For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/least-privilege-keys.