A Kubernetes service account bound to an overprivileged cloud identity may give its workloads permissions beyond their operational needs. Cloud resources can then be accessed or modified outside the workload's intended boundary, exposing protected data and allowing unauthorized changes to cloud state.
Workload Identity Grants Excessive Cloud Access
CCC.K8S.TH02
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP10 | Cloud Identity Integration | The service can authenticate cloud identities and authorize their access to cluster resources through Kubernetes and provider-native access controls. |
| CCC.K8S.CP11 | Workload Identity Federation | The service may be configured to exchange Kubernetes service-account identity for short-lived cloud credentials without placing long-lived credentials in workloads. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CN02 | Enforce Least-Privilege Cluster Authorization | Apply least privilege across cloud and Kubernetes authorization so identities receive only the permissions required for their cluster responsibilities. |
| CCC.K8S.CN03 | Use Federated Identities for Workloads | Replace stored cloud credentials with narrowly scoped, short-lived federated identity for workload access to cloud services. |
| CCC.K8S.CN17 | Restrict Cluster Infrastructure Identities | Limit cloud access by cluster infrastructure to the permissions and resources required for each platform responsibility. |