The service may be configured with distinct cloud identities for control-plane, worker-node, and supporting components so their access to cloud resources can be independently authorized.
Cluster Infrastructure Identity
CCC.K8S.CP21
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH17 | Cluster Infrastructure Identities Grant Excessive Cloud Access | Cloud identities used by control-plane, worker-node, or supporting components may be shared or granted permissions beyond their platform responsibilities. A component using such an identity can access or modify cloud resources outside its intended boundary. Protected cloud data may be disclosed, cloud resource integrity may be lost, and services required by the cluster may be disrupted. |