The service can issue long-term credentials, such as access keys, client secrets or service account keys, that remain valid until they are deleted or expire.
Long-Term Credentials
CCC.IAM.CP03
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.IAM.TH01 | Valid Cloud Credentials Abuse | Valid identity credentials such as access keys, tokens or passwords are misused or compromised. Examples include public exposure, token theft, unprotected metadata service of a compromised compute instance or brute-force attacks. The use of these credentials can provide unauthorized access to the cloud environment, potentially bypassing other security controls and enabling lateral movement across cloud resources. |
| CCC.IAM.TH04 | Credentials are Created Without Authorization | A principal holds permissions to create credentials, such as access keys, service account keys, client secrets or session tokens, beyond what its function requires, or a compromised identity holds such permissions. Additional credentials are then created outside the organization's provisioning process and remain valid after the originating access ends. This compromises the integrity of the access model and the confidentiality of every resource the new credentials can reach. |
| CCC.IAM.TH09 | Static Credentials Outlive Their Rotation Period | Long-lived static credentials such as access keys for an identity are used and not rotated periodically according to security best practices, extending exposure in the event of credentials compromise. |
| CCC.IAM.TH11 | Unused Credentials Remain Active | Unused IAM identity that is no longer needed or monitored remains active. Its compromise is less likely to be detected, and it represents a persistent, unnecessary attack surface. |