Rotate NewRelic license key

[FuhuXia]

Date of report: 2024-01-05
Severity:
Due date: now

Due date is based on severity and described in RA-5. 15-days for Critical, 30-days for High, and 90-days for Moderate and lower.

• Analysis has been performed and an issue has been linked to address other occurrences for this class of vulnerability* (link)

* When a finding is identified, we create two issues. One to address the specific instance identified in the report. The other is to identify and address all other occurrences of this vulnerability within the application.

Brief description

NewRelic license key was compromised. Not a security risk but we d like to rotate it now.

[FuhuXia]

Our NewRelic key is set as cf app environment valiable in three (prod, staging, development) management spaces.

[FuhuXia]

Added a new key named cloud.gov app log and used it for all cloud.gov logger shippers.
But the compromised one is the original account license key, per the doc, it can only be rotated by NR support.

https://docs.newrelic.com/docs/apis/intro-apis/new-relic-api-keys/#rotate-license-key

[FuhuXia]

NR Case #00178894 was created to request key rotation.

[FuhuXia]

NR supported completed the rotation of the original account license key. This ticket can be closed.