Access cloud resources

Info

ID: MS-TA7015
Tactic: Privilege Escalation, Lateral Movement
MITRE technique: T1078.004

Web apps deployed in the cloud often run with identities or service accounts that have permissions over additional cloud resources in the environment such as storage, databases and AI services. Additionally, some applications store connection strings or keys to cloud resources in the app configuration files or environment variables. Therefore, if attackers compromise the application, they can often extract or leverage these credentials to access additional cloud resources.

Mitigations

ID	Mitigation	Description
MS-M7017	Implement least-privilege access	Scope identity permissions tightly to specific resources and actions using resource-level policies and deny-by-default strategies.
MS-M7026	Use workload identities instead of static credentials	Avoid storing connection strings or access keys in application configuration. Use workload identities for resource access.