Management / Monitoring / Controls / v2026.11
Scope Telemetry Publishing Permissions
CCC.Monitor.CN06 · Access Control
Ensure that an identity can publish telemetry only for the resources it owns, so that a compromised workload or agent cannot fabricate telemetry about other systems or create unbounded metric series.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.Monitor.CP01 | Custom Metric Ingestion | The service can receive user-defined, numeric time-series data points pushed by applications or external systems through its API, in addition to the metrics it collects automatically from provider resources. |
| CCC.Monitor.CP02 | Distributed Tracing | The service may be configured to collect traces that link a single request to the resulting operations in downstream components and external systems, providing an end-to-end view of a transaction. |
| CCC.Monitor.CP11 | Integration with External Tools | The service may be configured to forward alerts, notifications, and metric data to external systems such as incident management, ticketing, or third-party observability platforms. |
| CCC.Monitor.CP12 | Agent-Based Telemetry Collection | The service can collect metrics and traces from compute instances through a provider-supplied agent that runs on the instance and authenticates to the service using the instance identity or a configured credential. |
| CCC.Monitor.CP10 | Alert-Triggered Actions | The service may be configured to invoke an automated action, such as a workflow, a function, or a scaling operation, when an alert condition is met, in addition to emitting a notification. |
| CCC.Core.CP09 | Metrics Publication | The service automatically publishes structured, numeric, time-series data points related to the performance, availability, and health of the service or its child resources. |
| CCC.Core.CP15 | Cost Management | The service monitors data published by child or networked resources to infer usage patterns and generate cost reports for the service. |
Related Threats
| ID | Title | Description |
|---|
| CCC.Monitor.TH05 | Telemetry is Used as a Data Exfiltration Channel | Custom metric values and dimensions, trace attributes, and agent-collected fields may be populated with encoded sensitive data by a compromised workload. The data is accepted as ordinary telemetry, staged in the monitoring service, and forwarded to external systems through configured integrations, bypassing controls applied to the workload's own network egress. This impacts the confidentiality of the exfiltrated data. |
| CCC.Monitor.TH06 | Telemetry Volume Inflates Monitoring Costs | Custom metrics and agent-collected telemetry are billed per metric series and per data point, and alert-triggered actions may invoke external systems that charge per request. A misconfigured or compromised workload can publish high-cardinality metrics or fire alerts at high frequency, and the resulting charges accrue before the pattern is detected. This impacts the availability of the monitoring budget and of systems whose scaling depends on it. |
| CCC.Monitor.TH09 | Telemetry Agent Credentials or Configuration are Compromised | A telemetry agent runs on the monitored instance with a credential that is authorized to publish telemetry and with a configuration that selects which host data is collected. If the credential is extracted or the configuration is modified, the agent can be made to collect arbitrary files or process data, or the credential can be reused to publish telemetry on behalf of other instances. This impacts the confidentiality of host data and the integrity of collected telemetry. |
| CCC.Core.TH08 | Runtime Metrics are Manipulated | Manipulation of runtime metrics can lead to inaccurate representations of system performance and resource utilization. This compromised data integrity may also impact system availability through misinformed scaling decisions, budget exhaustion, financial losses, and hindered incident detection. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.Monitor.CN06.AR01 | When an identity is granted permission to publish metrics or traces, the permission MUST be restricted to the metric namespaces or resources that the identity owns. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.Monitor.CN06.AR02 | When a telemetry agent authenticates to the service, it MUST use the platform identity of the instance it runs on rather than a stored long-lived credential. | tlp-clear, tlp-green, tlp-amber, tlp-red |