Check ID: organizations_service_account_secrets_expiration
Provider: MongoDB Atlas
Service: organizations
Severity: HIGH
Categories: secrets
Resource type: NotDefined

​
What this check verifies

MongoDB Atlas organization setting maxServiceAccountSecretValidityInHours caps the lifetime of new Admin API service account secrets. Evaluation focuses on whether a limit is configured and whether it is at or below the defined policy threshold (default 8 hours).

​
Risk

Overlong or unset lifetimes for Admin API service account secrets expand the attack window. If leaked, an adversary can maintain API access to:
  • Exfiltrate data (confidentiality)
  • Alter org or project configs (integrity)
  • Disable services or change access controls (availability)

​
Recommendation

Set a strict cap via maxServiceAccountSecretValidityInHours to 8 hours or less. Apply least privilege to service accounts, automate secret rotation/revocation, and monitor usage. Store secrets in a secure vault and limit where they can be used e.g., network allowlisting as part of defense in depth.

​
Remediation

curl --user "<PUBLIC_KEY>:<PRIVATE_KEY>" --digest -H "Content-Type: application/json" -X PATCH "https://cloud.mongodb.com/api/atlas/v2/orgs/<ORG_ID>/settings" --data '{"maxServiceAccountSecretValidityInHours":8}'

​
References

​
Where this check fires

This check runs on every scheduled scan against your MongoDB Atlas account. Findings appear at Cloud Security → Findings filterable by Check ID = organizations_service_account_secrets_expiration. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to MongoDB Atlas checks