Production credentials restricted with MFA and audit

Production credentials accessible without MFA mean a single compromised developer account — through phishing, credential stuffing, or a breached password manager — gives an attacker full access to modify environment variables, redeploy the application, or exfiltrate secrets. OWASP A07 (Identification & Authentication Failures) and NIST IA-3 both require strong authentication for administrative access. Without audit trails (NIST AU-2), you cannot determine whether a production credential was accessed after a breach, making incident response blind. Many insurance and compliance frameworks now require MFA for any system with access to production credentials.

Enable MFA enforcement at the platform level — individual developer settings are insufficient because they can be disabled. Also enable audit logging so any access to production environment variables is recorded.

Vercel: Team → Settings → Security → Require two-factor authentication Netlify: Team → Security → Enforce multi-factor authentication AWS IAM: Attach a policy requiring MFA before any production action:

aws iam create-policy \
  --policy-name RequireMFAForProd \
  --policy-document file://src/config/iam-mfa-policy.json

Review access logs monthly. For AWS, CloudTrail provides a full record of who accessed or changed secrets and when.