Limiting Third-Party Integration Credentials

General Principle: Least Privilege for Integrations

Recommendation: Configure third-party integration credentials (directory, cloud, IdP, API) with the minimum privileges required - prefer read-only roles - and separate these credentials from interactive administrator accounts.

Integration credentials are often long-lived and non-interactive. Over privileged integration accounts increase blast radius if compromised.

Active Directory (AD) Integration Accounts

Recommendation: Use a dedicated directory service account for AD / LDAP integrations with read-only permissions for user / group lookup and authentication. Do not use Domain Admin or highly privileged accounts.

Directory integrations typically do not require write permissions. Read only accounts reduce lateral movement risk.

Implementation reference:

sk93938 - Using Identity Awareness AD Query without Active Directory Administrator privileges

Cloud Controller Integrations (AWS, Azure, GCP)

Recommendation: Use cloud native roles / service accounts with read-only permissions for discovery. Add write permissions only if automation use cases require them.

Cloud credentials can expose large parts of your infrastructure and metadata. Read only roles reduce impact of credential compromise.

Examples (minimum privilege approach):

  • AWS: IAM role limited to Describe* APIs only (for discovery)

  • Azure: Service Principal / Managed Identity with Reader role

  • GCP: Service Account with Viewer role

Implementation reference:

R82.10 CloudGuard Controller Administration Guide > Configuring Permissions for Amazon Web Services.

Identity Provider and API Integrations

Recommendation: Scope API credentials / tokens to the minimum required roles and APIs. Avoid using full administrative API tokens for integrations that only need authentication or limited identity attributes. Use certificates for authentication where possible, create API keys for a duration of two months and do not store these in clear-text file repositories.

Broad API permissions can allow unintended configuration changes if the token is exposed.

Implementation reference:

R82.10 Security Management Administration Guide > Managing Security through API, Creating an Administrator Account with API Key Authentication.