ILLUSTRATIVE DELIVERABLE / NOT A CLIENT RESULT
What an actionable finding looks like.
This fictional example shows the structure of a finding. Actual evidence, severity, scope, and validation are specific to your environment.
Deployment role grants broader access than its workload needs.
Observation: An example deployment role permits changes across multiple application resources. The workflow only requires access to one application environment.
Business impact
If the pipeline credential is compromised, the attacker may change resources beyond the intended application boundary. Severity depends on effective permissions, reachable resources, and compensating controls.
Evidence to collect
Role and policy identifiers, permission statements, trust relationships, workflow configuration, and relevant access records. Sensitive values are redacted and handling follows the agreed retention policy.
Recommended change
Replace broad permissions with the actions and resources required by the workflow. Restrict role assumption, use short-lived credentials where supported, and review the change in infrastructure as code.
Acceptance and verification
The approved deployment succeeds; attempts to access unrelated resources are denied. Record the validation method, date, environment, reviewer, and remaining exceptions. State explicitly when a control has not been tested.