Limit cloud access by cluster infrastructure to the permissions and resources required for each platform responsibility.
Restrict Cluster Infrastructure Identities
CCC.K8S.CN17 · Access
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP10 | Cloud Identity Integration | The service can authenticate cloud identities and authorize their access to cluster resources through Kubernetes and provider-native access controls. |
| CCC.K8S.CP11 | Workload Identity Federation | The service may be configured to exchange Kubernetes service-account identity for short-lived cloud credentials without placing long-lived credentials in workloads. |
| CCC.K8S.CP02 | Managed Worker Pools | The service can organize worker nodes into managed pools that provide Kubernetes with compute capacity for scheduling and running containerized workloads. |
| CCC.K8S.CP21 | Cluster Infrastructure Identity | The service may be configured with distinct cloud identities for control-plane, worker-node, and supporting components so their access to cloud resources can be independently authorized. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.K8S.TH02 | Workload Identity Grants Excessive Cloud Access | A Kubernetes service account bound to an overprivileged cloud identity may give its workloads permissions beyond their operational needs. Cloud resources can then be accessed or modified outside the workload's intended boundary, exposing protected data and allowing unauthorized changes to cloud state. |
| CCC.K8S.TH17 | Cluster Infrastructure Identities Grant Excessive Cloud Access | Cloud identities used by control-plane, worker-node, or supporting components may be shared or granted permissions beyond their platform responsibilities. A component using such an identity can access or modify cloud resources outside its intended boundary. Protected cloud data may be disclosed, cloud resource integrity may be lost, and services required by the cluster may be disrupted. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.K8S.CN17.AR01 | Control-plane, worker-node, and supporting components with distinct security responsibilities MUST use independently governed cloud identities. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.K8S.CN17.AR02 | Each cluster infrastructure identity MUST grant only the cloud actions and resource scope required for its platform responsibility. | tlp-clear, tlp-green, tlp-amber, tlp-red |