Skip to main content
Checks that Nebius service account keys/tokens are rotated within the configured window.

​
About

When you connect Nebius to DSALTA, the platform reads your service account keys using read-only IAM access and flags any key older than the configured rotation threshold (90 days by default). DSALTA evaluates this control on every sync.

​
Why This Matters

Long-lived credentials increase the blast radius of a leaked key — the older a key is, the more time an attacker has to find and abuse it. Regular key rotation is expected by frameworks including SOC 2, ISO 27001:2022, NIST CSF, and CIS.

​
How to Fix

Before you begin
  • Review the service account keys flagged as past the rotation window in the DSALTA check details.
  • Ensure you have tenant admin rights in the Nebius Console.
Rotate keys
  1. In the Nebius Console, go to IAM → Service accounts.
  2. Open the affected service account and go to its keys.
  3. Create a new key and update any system that uses the old one.
  4. Delete the old key once the new key is in use.
Once all service account keys are younger than the configured rotation window, DSALTA retrieves the change on the next sync and sets the check status to Passing.

​
Frequently Asked Questions

This check runs automatically every 24 hours while the Nebius integration is connected. You can also trigger a manual sync from Integrations in the sidebar.
A failing check appears in your Data Library → Tests dashboard. Work through the steps above; once the underlying configuration is fixed, the status updates automatically on the next sync.
Yes. If it does not apply to your environment, mark it as Not Applicable with a justification. The exclusion is documented for auditors.
No. DSALTA uses read-only IAM access and never modifies, creates, or deletes resources. All remediation is performed by your team directly in Nebius.