Replace stored cloud credentials with narrowly scoped, short-lived federated identity for workload access to cloud services.
Use Federated Identities for Workloads
CCC.K8S.CN03 · Access
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP10 | Cloud Identity Integration | The service can authenticate cloud identities and authorize their access to cluster resources through Kubernetes and provider-native access controls. |
| CCC.K8S.CP11 | Workload Identity Federation | The service may be configured to exchange Kubernetes service-account identity for short-lived cloud credentials without placing long-lived credentials in workloads. |
| CCC.K8S.CP12 | Secrets Service Integration | The service can present secrets, keys, and certificates from a cloud secrets service to authorized Kubernetes workloads without embedding them in workload definitions. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH02 | Workload Identity Grants Excessive Cloud Access | A Kubernetes service account bound to an overprivileged cloud identity may give its workloads permissions beyond their operational needs. Cloud resources can then be accessed or modified outside the workload's intended boundary, exposing protected data and allowing unauthorized changes to cloud state. |
| CCC.K8S.TH03 | Long-Lived Credentials are Exposed to Workloads | Long-lived cloud credentials stored in workload configuration, container images, environment variables, or mounted files may be read by a compromised workload or unauthorized user. The credentials can then be used independently of the workload lifecycle. Protected data may be disclosed and resources accessible through those credentials may be modified outside the cluster's authorization controls. |
| CCC.K8S.TH07 | Secrets are Exposed to Unauthorized Workloads | Misconfigured secret access, namespace boundaries, or workload mounts may expose sensitive values to workloads or users that do not require them. Credentials, keys, or certificates can then be read from Kubernetes or external secret interfaces, exposing the secrets and enabling unauthorized changes to the resources they protect. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.K8S.CN03.AR01 | When a workload accesses a cloud API, its Kubernetes service account MUST be bound to a dedicated cloud identity that issues short-lived credentials through workload identity federation. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN03.AR02 | When workload identity federation is enabled, workload specifications and Kubernetes configuration objects MUST NOT contain long-lived cloud access keys, client secrets, or service-account key files. | tlp-clear, tlp-green, tlp-amber, tlp-red |