Enumerate every trust relationship the platform will admit to

applied · 70 min · Objective 2.3

Task

Apply objective 2.3: list every integration from the PLATFORM rather than from your records, compare against what you thought you had, and give each an owner and an expiry.

Steps

  1. Enumerate by API: role trust policies, federated applications, consent grants, cross-account roles, long-lived keys, service principals, and any partner connection. Write to lab/trust-enumerated.csv as type,principal,scope,created,last_used.
  2. Compare against your own records in lab/cmdb.csv and produce lab/trust-diff.csv marking each as recorded, unrecorded or recorded-but-absent.
  3. For every unrecorded relationship, add it to the CMDB with an owner, a purpose and an EXPIRY date.
  4. Remove at least one relationship that no longer has a purpose, and capture the before-and-after enumeration.
  5. Write lab/trust-note.md on why short-lived by construction is the only control here that does not depend on somebody remembering.

Verify

awk -F, 'NR>1 {n++} END {print n" trust relationship(s)"}' lab/trust-enumerated.csv
awk -F, 'NR>1 {print $NF}' lab/trust-diff.csv | sort | uniq -c
awk -F, 'NR>1 {print $1}' lab/trust-enumerated.csv | sort -u | wc -l
grep -Eci 'short-lived|expire|revocation|by construction' lab/trust-note.md

Four or more relationship TYPES enumerated, at least one unrecorded found, and the note written. Enumerating from your records rather than from the platform reproduces the failure -- the record is the thing that is incomplete.

This is an independent study companion for CompTIA SecurityX CAS-005 and is not produced by or endorsed by CompTIA.