The service may be configured to authenticate database users with short-lived tokens issued to the cloud provider's identity principals, so that no long-lived database password needs to be stored or rotated.
Cloud Identity Authentication
CCC.RDMS.CP17
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.RDMS.TH07 | Excessive Privileges are Granted Within the Database | Database roles and grants inside the engine may be configured more broadly than required, such as application users holding administrative roles or schemas readable by every login. Any authenticated user can then read or modify data beyond their function, impacting the confidentiality and integrity of all data in the instance. |
| CCC.RDMS.TH08 | Long-lived Database Credentials are Exposed | Static usernames and passwords may be stored in application configuration, connection strings, or source repositories and remain valid for long periods. When such a credential is disclosed it can be reused by an unauthorized party until it is rotated, impacting the confidentiality and integrity of the database. |