Long-lived cloud credentials stored in workload configuration, container images, environment variables, or mounted files may be read by a compromised workload or unauthorized user. The credentials can then be used independently of the workload lifecycle. Protected data may be disclosed and resources accessible through those credentials may be modified outside the cluster's authorization controls.
Long-Lived Credentials are Exposed to Workloads
CCC.K8S.TH03
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP11 | Workload Identity Federation | The service may be configured to exchange Kubernetes service-account identity for short-lived cloud credentials without placing long-lived credentials in workloads. |
| CCC.K8S.CP12 | Secrets Service Integration | The service can present secrets, keys, and certificates from a cloud secrets service to authorized Kubernetes workloads without embedding them in workload definitions. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CN03 | Use Federated Identities for Workloads | Replace stored cloud credentials with narrowly scoped, short-lived federated identity for workload access to cloud services. |
| CCC.K8S.CN07 | Protect Workload Secrets | Protect workload secrets through encrypted handling, narrow authorization, and removal from images and non-secret configuration objects. |