The service may be configured to exchange Kubernetes service-account identity for short-lived cloud credentials without placing long-lived credentials in workloads.
Workload Identity Federation
CCC.K8S.CP11
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH02 | Workload Identity Grants Excessive Cloud Access | A Kubernetes service account bound to an overprivileged cloud identity may give its workloads permissions beyond their operational needs. Cloud resources can then be accessed or modified outside the workload's intended boundary, exposing protected data and allowing unauthorized changes to cloud state. |
| CCC.K8S.TH03 | Long-Lived Credentials are Exposed to Workloads | Long-lived cloud credentials stored in workload configuration, container images, environment variables, or mounted files may be read by a compromised workload or unauthorized user. The credentials can then be used independently of the workload lifecycle. Protected data may be disclosed and resources accessible through those credentials may be modified outside the cluster's authorization controls. |