Database / Relational / Controls / v2026.11
Authenticate Users with Cloud Identity
CCC.RDMS.CN08 · Access Control
Ensure that database users authenticate with short-lived tokens issued to cloud identity principals, so that no long-lived password exists to be exposed and reused.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.RDMS.CP07 | DB Self Managed Credentials | The service always supports database users authenticated by a username and password that the user creates and manages. |
| CCC.RDMS.CP17 | Cloud Identity Authentication | The service may be configured to authenticate database users with short-lived tokens issued to the cloud provider's identity principals, so that no long-lived database password needs to be stored or rotated. |
Related Threats
| ID | Title | Description |
|---|
| CCC.RDMS.TH08 | Long-lived Database Credentials are Exposed | Static usernames and passwords may be stored in application configuration, connection strings, or source repositories and remain valid for long periods. When such a credential is disclosed it can be reused by an unauthorized party until it is rotated, impacting the confidentiality and integrity of the database. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.RDMS.CN08.AR01 | When a database user connects, the service MUST authenticate the user with a token issued to a cloud identity principal rather than a static password. | tlp-red |
| CCC.RDMS.CN08.AR02 | When a static database password is in use, it MUST have been rotated within the past 90 days. | tlp-amber, tlp-red |