Crypto / Secrets / Controls / v2026.11
Enforce Least-Privilege Access to Secret Values
CCC.SecMgmt.CN03 · Access Control
Ensure that only the identities that consume a secret can read its value, and that an identity which only consumes a secret cannot replace its value.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.SecMgmt.CP01 | Secret Storage | The service always stores sensitive values such as API keys, passwords, and certificates as named secrets that can be retrieved only by authorized users and external systems. |
| CCC.SecMgmt.CP02 | Secret Creation - Plaintext | The service can create a secret whose value is a plain text string, for sensitive data such as API keys and database credentials. |
| CCC.SecMgmt.CP04 | Secret Creation - Binary Data | The service can create a secret whose value is binary data, such as a certificate or private key file. Providers that accept only string values require the binary content to be encoded before storage. |
| CCC.Core.CP06 | Access Control | The service automatically enforces user configurations to restrict or allow access to a specific component or a child resource based on factors such as user identities, roles, groups, or attributes. |
| CCC.Core.CP14 | API Access | The service exposes a port enabling external actors to interact programmatically with the service and its resources using HTTP protocol methods such as GET, POST, PUT, and DELETE. |
| CCC.Core.CP28 | Command-line Interface | The service includes a component that reads and translates text into commands that can be executed by the service. |
| CCC.SecMgmt.CP05 | Update Secrets | The service can update the value or metadata of an existing secret after creation, and automatically stores an updated value as a new version of that secret. |
| CCC.Core.CP18 | Resource Versioning | The service automatically assigns versions to child resources which can be used to preserve, retrieve, and restore past iterations. |
| CCC.Core.CP05 | Signed URLs | The service can generate an ad hoc URL containing authentication information to enforce user-configured permissions for accessing a specific component or a child resource. |
| CCC.Core.CP23 | Network Access Rules | The service restricts access to child or networked resources based on user-defined network parameters such as IP address, protocol, port, or source. |
| CCC.Core.CP29 | Active Ingestion | While running, the service itself can fetch or reach out to some other service or external source to get data, inputs or commands for the service to process or operate on. |
| CCC.Core.CP33 | Public Access Restriction | The service may be configured to deny all access to a child resource from the public internet, regardless of any resource-level permission that would otherwise grant it. |
Related Threats
| ID | Title | Description |
|---|
| CCC.SecMgmt.TH01 | Secret Values are Exposed Outside the Service | A secret value retrieved through the API or command-line interface may be written to terminal output, shell history, build logs, environment variables, or application logs, or may be readable by any identity holding a broad read permission on the secret. Plaintext copies of the value then exist outside the service's access control and audit trail. The confidentiality of the credential is lost, and the credential could be used to access the systems it protects. |
| CCC.SecMgmt.TH02 | Secret Values are Replaced by Unauthorized Entities | Write permission on a secret may be granted more broadly than read permission, or may be obtained through a compromised identity, allowing a new version to be stored with a value chosen by the writer. External systems that consume the secret then authenticate with the substituted credential or connect to an endpoint named in it, redirecting data to an unintended destination or failing to authenticate. The integrity of the credential and the availability of the systems that depend on it are affected. |
| CCC.Core.TH01 | Access is Granted to Unauthorized Users | Logic designed to give different permissions to different entities may be misconfigured or manipulated, allowing unauthorized entities to access restricted parts of the service, its data, or its child resources. This could result in a loss of data confidentiality or tolerance of unauthorized actions which impact the integrity and availability of resources and data. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.SecMgmt.CN03.AR01 | When a secret's access policy is configured, read permission on the secret value MUST NOT be granted to a wildcard principal. | tlp-green, tlp-amber, tlp-red |
| CCC.SecMgmt.CN03.AR02 | When read permission on a secret value is granted, the grant MUST be scoped to the specific secret, vault, or tag-scoped set of secrets that the identity consumes. | tlp-amber, tlp-red |
| CCC.SecMgmt.CN03.AR03 | When an identity is granted read permission on a secret value for consumption by a workload, that grant MUST NOT include permission to create a new version of the secret. | tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST-CSF | PR.AC-4 | Access permissions and authorizations are managed |
| NIST_800_53 | AC-6 | Least Privilege |