OWASP Cloud-Native Application Security Top 10
This skill encodes the OWASP Cloud-Native Application Security Top 10 for secure cloud-native design and review. References are loaded per risk. Based on OWASP Cloud-Native Application Security Top 10 2022. The official list defines 6 risks (CNAS-1 to CNAS-6); the project is archived.
When to Read Which Reference
| Risk | Read |
|---|---|
| CNAS-1 Insecure cloud, container or orchestration configuration | references/cnas-1-insecure-configuration.md |
| CNAS-2 Injection flaws | references/cnas-2-injection-flaws.md |
| CNAS-3 Improper authentication and authorization | references/cnas-3-auth.md |
| CNAS-4 CI/CD pipeline and software supply chain flaws | references/cnas-4-cicd-supply-chain.md |
| CNAS-5 Insecure secrets storage | references/cnas-5-secrets-storage.md |
| CNAS-6 Over-permissive or insecure network policies | references/cnas-6-network-policies.md |
Quick Patterns
- •Harden cloud and container config; validate input and avoid injection; enforce auth and least privilege; secure CI/CD and supply chain; protect secrets; apply network segmentation.
Quick Reference / Examples
| Task | Approach |
|---|---|
| Harden containers | Non-root, minimal base images, read-only fs. See CNAS-1. |
| Prevent injection | Parameterized queries, validate cloud event data. See CNAS-2. |
| Secure auth | Use managed identity (IAM roles), short-lived tokens. See CNAS-3. |
| Protect CI/CD | Sign artifacts, verify dependencies, secure pipelines. See CNAS-4. |
| Manage secrets | Use cloud secrets manager, never in code/env. See CNAS-5. |
Safe - minimal Dockerfile:
dockerfile
FROM gcr.io/distroless/python3-debian12 COPY --chown=nonroot:nonroot app.py /app/ USER nonroot ENTRYPOINT ["python3", "/app/app.py"]
Unsafe - bloated image with root:
dockerfile
FROM ubuntu:latest RUN apt-get update && apt-get install -y python3 curl vim # Attack surface COPY app.py /app/ # Running as root by default
Secrets via AWS Secrets Manager:
python
import boto3
client = boto3.client("secretsmanager")
secret = client.get_secret_value(SecretId="prod/db/password")
db_password = secret["SecretString"]
Workflow
Load the reference for the risk you are addressing. See OWASP Cloud-Native Application Security Top 10 (archived).