Secret Values are Exposed Outside the Service

CCC.SecMgmt.TH01

A secret value retrieved through the API or command-line interface may be written to terminal output, shell history, build logs, environment variables, or application logs, or may be readable by any identity holding a broad read permission on the secret. Plaintext copies of the value then exist outside the service's access control and audit trail. The confidentiality of the credential is lost, and the credential could be used to access the systems it protects.

Related Capabilities

ID	Title	Description
CCC.SecMgmt.CP01	Secret Storage	The service always stores sensitive values such as API keys, passwords, and certificates as named secrets that can be retrieved only by authorized users and external systems.
CCC.SecMgmt.CP02	Secret Creation - Plaintext	The service can create a secret whose value is a plain text string, for sensitive data such as API keys and database credentials.
CCC.SecMgmt.CP04	Secret Creation - Binary Data	The service can create a secret whose value is binary data, such as a certificate or private key file. Providers that accept only string values require the binary content to be encoded before storage.
CCC.Core.CP06	Access Control	The service automatically enforces user configurations to restrict or allow access to a specific component or a child resource based on factors such as user identities, roles, groups, or attributes.
CCC.Core.CP14	API Access	The service exposes a port enabling external actors to interact programmatically with the service and its resources using HTTP protocol methods such as GET, POST, PUT, and DELETE.
CCC.Core.CP28	Command-line Interface	The service includes a component that reads and translates text into commands that can be executed by the service.

Related Controls

ID	Title	Description
CCC.SecMgmt.CN03	Enforce Least-Privilege Access to Secret Values	Ensure that only the identities that consume a secret can read its value, and that an identity which only consumes a secret cannot replace its value.