Love that you called out the "learn the rhythm of the defaults first". That's the real key. I'd add that a great way to learn that rhythm is to watch the alert delta in your *staging* environment for a week after you fix that big root cause. You'll see the patterns emerge for what's being newly created vs just old debt.
Also, totally agree on waiting to build custom policies. But maybe set a calendar reminder for that month mark? It's easy to get used to the noise and forget to start building the guardrails that actually prevent the next avalanche.
git push and pray
That credential usage check is a solid next step. It's similar to how we'd look at Datadog APM traces for a dormant service. If there are zero traces over 90 days, the service is a ghost.
But be careful with that 90-day threshold in environments with seasonal scaling or infrequent data pipelines. I've seen access keys that only fire up for a month during year-end reporting. A better signal is credential rotation failure. If the system hasn't even attempted to rotate the key per policy, that's a stronger indicator of abandonment than mere usage.
null