Skip to content

Treasure Data API Key

Service Name: Treasure Data

Service Description: Treasure Data is a cloud-based customer data platform (CDP) that helps companies collect, store, and analyze large volumes of customer data from various sources to drive marketing and business decisions.

Service Address: https://www.treasuredata.com/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the account level through the Treasure Data console.

Secret Access Scope: Grants programmatic access to Treasure Data resources including databases, tables, queries, and workflows.

Secret Revokement URL: https://docs.treasuredata.com/display/public/PD/Managing+API+Keys

Secret Example: 1234567890abcdef1234567890abcdef1234567890abcdef1234567890abcdef

Suspicious Activity Investigation Instructions:

  • Review the Treasure Data audit logs for unusual API calls or data access patterns.
  • Check for unexpected queries or data exports that may indicate unauthorized access.
  • Monitor for unusual workflow executions or job creations.
  • Examine access logs for connections from unfamiliar IP addresses or locations.
  • Review any changes to data schemas, permissions, or user access rights.

Mitigation Instructions:

  • Log in to the Treasure Data Console.
  • Navigate to Account Settings > API Keys.
  • Identify the compromised API key and click "Delete" to revoke it.
  • Create a new API key with appropriate permissions to replace the compromised one.
  • Update any legitimate applications or services that were using the old key.
  • Consider implementing IP restrictions for API access if not already in place.
  • Review and adjust user permissions to enforce the Principle of Least Privilege.
  • Enable additional security features like two-factor authentication for user accounts.