Skip to main content

Workload Identity Grants Excessive Cloud Access

CCC.K8S.TH02

A Kubernetes service account bound to an overprivileged cloud identity may give its workloads permissions beyond their operational needs. Cloud resources can then be accessed or modified outside the workload's intended boundary, exposing protected data and allowing unauthorized changes to cloud state.

Related Capabilities

IDTitleDescription
CCC.K8S.CP10Cloud Identity IntegrationThe service can authenticate cloud identities and authorize their access to cluster resources through Kubernetes and provider-native access controls.
CCC.K8S.CP11Workload Identity FederationThe service may be configured to exchange Kubernetes service-account identity for short-lived cloud credentials without placing long-lived credentials in workloads.

Related Controls

IDTitleDescription
CCC.K8S.CN02Enforce Least-Privilege Cluster AuthorizationApply least privilege across cloud and Kubernetes authorization so identities receive only the permissions required for their cluster responsibilities.
CCC.K8S.CN03Use Federated Identities for WorkloadsReplace stored cloud credentials with narrowly scoped, short-lived federated identity for workload access to cloud services.
CCC.K8S.CN17Restrict Cluster Infrastructure IdentitiesLimit cloud access by cluster infrastructure to the permissions and resources required for each platform responsibility.

External Mappings

FrameworkIDRelationshipRemarks
CWECWE-269relates-toImproper Privilege Management
MITRE-ATT&CKT1078.004relates-toValid Accounts - Cloud Accounts
MITRE-ATT&CKT1098.003relates-toAccount Manipulation - Additional Cloud Roles