OWASP NHI Top 10 – Insecure Cloud Deployment Configurations

Overview

Insecure Cloud Deployment Configurations occur when CI/CD pipelines, service identities, or trust relationships in cloud platforms are misconfigured, leading to unintended access or exposure of non-human identities (NHIs). These weaknesses open the door to supply chain attacks, privilege abuse, and lateral movement across environments.

What Are Insecure Cloud Deployment Configurations?

CI/CD platforms enable organizations to build and deploy software efficiently, often using NHIs such as service accounts or machine credentials. These identities authenticate with cloud services using either static credentials or federated identity models like OIDC.

While OIDC offers a secure, ephemeral authentication method, misconfigurations—like improperly restricted claims or overly broad IAM roles—can expose sensitive infrastructure. Static credentials are even riskier, as they can be leaked through logs, code, or CI/CD pipeline files, giving attackers direct access to production environments.

How Do Insecure Cloud Deployment Configurations Work?

• CI/CD pipelines rely on identities to authenticate with cloud services
• Static secrets, when leaked, provide persistent and often privileged access
• OIDC configurations that lack claim validation allow unauthorized role assumptions
• IAM roles with overly permissive trust relationships increase blast radius

These risks become critical when attackers obtain even basic access, allowing them to recon the environment and escalate quickly.

Why Do Insecure Cloud Deployment Configurations Matter?

According to the CSA NHI Report, 32% of NHI-related incidents were caused by misconfigured environments. These vulnerabilities are highly exploitable and frequently go unnoticed until an attacker gains access via a misused pipeline or leaked identity.

As NHIs are often tied to cloud automation and CI/CD platforms, they are inherently high-privilege. Improper configuration means a threat actor can bypass MFA, impersonate trusted pipelines, or move laterally across environments—turning a single misconfiguration into a full compromise.

This threat also intersects with secret leakage, insecure authentication, and overprivileged NHIs.

Astrix’s Solution for Insecure Cloud Deployment Configurations

Astrix helps secure CI/CD environments and cloud identity configurations by:

• Discovering Non-Human Identities used across pipelines and deployments
• Detecting Suspicious Non-Human Activity that suggests role misuse or token abuse
• Protecting secrets to eliminate static credentials from configurations
• Enforcing NHI governance and least privilege policies across IAM roles and trust relationships

Whether preventing token misuse or remediating dangerous defaults, Astrix gives security teams full visibility and control over deployment identity risks.

Don’t let misconfigured pipelines become your weakest link. Explore how Astrix helps secure CI/CD integrations and enforces zero trust principles for non-human identities.

Learn more about the OWASP NHI Top 10 framework in Astrix’s introduction to the standard → Introducing the OWASP NHI Top 10.