Data exfiltration control

A system, comprising at least one computing device implementing one or more services, wherein the one or more services:

• obtains a service request and a credential associated with the service request;
• identifies a network address from which the service request was sent;
• obtains information that describes allowable credentials based at least in part on the network address from which the service request was sent;
• determines that the credential associated with the service request is not allowed because the credential is associated with a request obtained from the network address, based at least in part on the information that describes the allowable credentials;
• and
• as a result of determining that the credential associated with the service request is not allowed and that the service request originates from the network address, denies the service request.

A non-transitory computer-readable storage medium including stored thereon executable instructions that, as a result of being executed by one or more processors of a computer system, cause the computer system to at least:

• obtain a credential from a customer environment;
• identify the customer environment based at least in part on a network address associated with the source of a service request;
• determine a set of allowable credentials for the service request based at least in part on the network address associated with the source of the service request;
• determine that the credential is not in the set of allowable credentials;
• and
• as a result of having determined that the credential was provided from the network address and is not in the set of allowable credentials, deny the service request that would otherwise be allowable with the credential.