A secret value retrieved through the API or command-line interface may be written to terminal output, shell history, build logs, environment variables, or application logs, or may be readable by any identity holding a broad read permission on the secret. Plaintext copies of the value then exist outside the service's access control and audit trail. The confidentiality of the credential is lost, and the credential could be used to access the systems it protects.
Secret Values are Exposed Outside the Service
CCC.SecMgmt.TH01
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.SecMgmt.CP01 | Secret Storage | The service always stores sensitive values such as API keys, passwords, and certificates as named secrets that can be retrieved only by authorized users and external systems. |
| CCC.SecMgmt.CP02 | Secret Creation - Plaintext | The service can create a secret whose value is a plain text string, for sensitive data such as API keys and database credentials. |
| CCC.SecMgmt.CP04 | Secret Creation - Binary Data | The service can create a secret whose value is binary data, such as a certificate or private key file. Providers that accept only string values require the binary content to be encoded before storage. |
| CCC.Core.CP06 | Access Control | The service automatically enforces user configurations to restrict or allow access to a specific component or a child resource based on factors such as user identities, roles, groups, or attributes. |
| CCC.Core.CP14 | API Access | The service exposes a port enabling external actors to interact programmatically with the service and its resources using HTTP protocol methods such as GET, POST, PUT, and DELETE. |
| CCC.Core.CP28 | Command-line Interface | The service includes a component that reads and translates text into commands that can be executed by the service. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.SecMgmt.CN03 | Enforce Least-Privilege Access to Secret Values | Ensure that only the identities that consume a secret can read its value, and that an identity which only consumes a secret cannot replace its value. |