Tema
Revisión trimestral de cuentas de aplicación y sistema — Q2 2026
| Campo | Valor |
|---|---|
| Cycle | Q2 2026 (primera ejecución del proceso TMPL-008) |
| Review period | 2026-04-01 → 2026-06-30 |
| TRA reference | TRA-001 v1.0 emitido 2026-06-16 |
| Proposing CTO | Gabriel Ureña — [email protected] |
| Reviewing CISO | Gabriel Ureña (acting CISO) |
| DevOps confirmation | 2026-06-16 (CTO = DevOps en single-person org) |
| PCI DSS | Req 7.2.5 + 7.2.5.1 |
| Plantilla | TMPL-008 v1.0 |
Resumen ejecutivo: Primera ejecución del proceso trimestral. Revisados 29 service accounts across 11 plataformas. Resultado: 24 KEEP · 1 REMOVE (cleanup test_inactive_demo via DO API) · 2 ROTATE (Kong + GoPhish API keys quarterly) · 2 EXEMPT.
1. Plataforma 1 — Categoría A · DB primary admin
Fuente: doctl databases user list ... --format Name,Role (role=primary).
| SA | Plataforma | Privilegio | Usado últimos 90d | Decisión | Justificación |
|---|---|---|---|---|---|
| doadmin | PG prod (061abee8-...) | DB superuser | YES (CTO ops) | KEEP | Required by DBaaS; rotable only via DO console; protected by VPC + IP allowlist |
| doadmin | PG staging (75917799-...) | DB superuser | YES (staging) | KEEP | Same as above; staging |
Sub-total cat A: 2 KEEP.
2. Plataforma 2 — Categoría B · K8s cluster-admin SA
Fuente: kubectl get sa -n rbac-sod.
| SA | Privilegio | Usado últimos 90d | Decisión | Justificación |
|---|---|---|---|---|
| admin-prod | cluster-admin | YES (CTO break-glass + on-call) | KEEP | Required for emergency ops; bound to ClusterRole cluster-admin |
| deployer-prod | custom (rollouts namespace-scoped) | YES (GitHub Actions CI/CD) | KEEP | Used by microservices-eks-deploy.yml workflow |
Sub-total cat B: 2 KEEP.
3. Plataforma 3 — Categoría C · App production service accounts
3.1 PostgreSQL prod application SA
| SA | Plataforma | Privilegio | Usado últimos 90d | Decisión | Justificación |
|---|---|---|---|---|---|
| fintrix_app | PG prod | app schema RW | YES (continuous from microservices) | KEEP | Required by payments-api, auth-service, tokenization-service, etc. |
3.2 K8s default SA per namespace
K8s genera un default SA por cada namespace. Estos NO tienen privilegios (no bound a ningún Role/ClusterRole). Se incluyen para completitud audit.
| SA | Namespace | Privilegios bound | Decisión | Justificación |
|---|---|---|---|---|
| default | app | NONE | KEEP | Auto-generado por K8s; sin bindings → 0 acceso |
| default | cde | NONE | KEEP | Auto-generado; sin bindings |
| default | kafka | NONE | KEEP | Auto-generado; sin bindings |
| default | default | NONE | KEEP | Auto-generado; sin bindings |
| default | rbac-sod | NONE | KEEP | Auto-generado; sin bindings |
| default | waf | NONE | KEEP | Auto-generado; sin bindings |
| default | wazuh | NONE | KEEP | Auto-generado; sin bindings |
| default | logging | NONE | KEEP | Auto-generado; sin bindings |
| default | monitoring | NONE | KEEP | Auto-generado; sin bindings |
| default | phishing-sim | NONE | KEEP | Auto-generado; sin bindings |
| default | falco | NONE | KEEP | Auto-generado; sin bindings |
3.3 K8s workload SAs
| SA | Namespace | Privilegio | Usado últimos 90d | Decisión |
|---|---|---|---|---|
| kong-kong | default | Kong ingress controller | YES | KEEP |
| falco | falco | Read pods/events for runtime detection | YES | KEEP |
| falco-falcosidekick | falco | Forward Falco alerts | YES | KEEP |
| fluent-bit | logging | Read pod logs from all NS | YES | KEEP |
Sub-total cat C: 16 KEEP (1 PG + 11 default + 4 workload).
4. Plataforma 4 — Categoría D · Read-only service accounts
| SA | Plataforma | Privilegio | Usado últimos 90d | Decisión | Justificación |
|---|---|---|---|---|---|
| fintrix_readonly | PG prod | SELECT only | UNKNOWN (BI/reports esporádico) | KEEP | Used by ad-hoc reports; low risk |
| viewer-prod | K8s rbac-sod | view role | NEVER | EXEMPT | RBAC slot pre-configured for auditors; flagged in Q1031 too |
Sub-total cat D: 1 KEEP · 1 EXEMPT.
5. Plataforma 5 — Categoría E · Infra automation tokens
| Token | Plataforma | Privilegio | Usado últimos 90d | Decisión | Justificación |
|---|---|---|---|---|---|
| default PAT | DO API | Full account access | YES (continuous doctl ops) | KEEP | Required for doctl CLI from CTO laptop; bound to CTO 2FA |
| fintrix-terraform-runner App | GitHub Apps | Repo admin for terraform.yml workflow | YES (every infra change) | KEEP | Required by terraform.yml workflow |
Sub-total cat E: 2 KEEP.
6. Plataforma 6 — Categoría F · Vendor service accounts
| SA | Plataforma | Privilegio | Decisión | Justificación |
|---|---|---|---|---|
| controlcase_auditor | PG prod | Read-only audit role | EXEMPT | QSA temporal; removal scheduled 2026-08-31 (per Q1031 H1 review) |
| kibanaserver | Wazuh OpenSearch | Dashboard ↔ indexer | KEEP | Service required by Wazuh dashboard; rotated 2026-05-27 (Q45) |
| wazuh-wui | Wazuh manager API | API service | KEEP | Required by Wazuh dashboard; rotated 2026-05-27 (Q45) |
| admin (Wazuh) | Wazuh OpenSearch | superuser | KEEP | Required; password rotated Q45 from default SecretPassword |
Sub-total cat F: 3 KEEP · 1 EXEMPT.
7. Plataforma 7 — Categoría G · Compensating-control service accounts
| SA | Plataforma | Privilegio | Decisión | Justificación |
|---|---|---|---|---|
| Kong admin API key | Kong gateway | Admin ops | ROTATE | Quarterly per TRA-001 §1.4 cat G. New key generated 2026-06-16 |
| GoPhish API key | GoPhish | Console + API admin | ROTATE | Quarterly per TRA-001 §1.4 cat G. New key generated 2026-06-16 |
| Coraza WAF (ConfigMap) | K8s waf NS | Rules update | KEEP | No API key (gitops via ConfigMap edits) |
Sub-total cat G: 1 KEEP · 2 ROTATE.
8. Plataforma 8 — Cleanup ejecutado · cuentas REMOVE
| SA | Plataforma | Decisión | Razón | Comando ejecutado |
|---|---|---|---|---|
| test_inactive_demo | PG staging | REMOVE | Q1031 documentó remove pero DROP ROLE no aplica via DO DBaaS API. Re-ejecutado via doctl 2026-06-16 19:55. | doctl databases user delete 75917799-1bf3-4cc3-85d6-71b9dba38e3d test_inactive_demo --force |
Resultado verificación: doctl databases user list 75917799-... --format Name,Role → solo doadmin primary. CONFIRMADO REMOVED.
Sub-total cleanup: 1 REMOVE ejecutado.
9. Resumen de acciones del ciclo Q2 2026
Total service accounts revisados: 29
KEEP: 24 (83%)
DOWNGRADE: 0
ROTATE: 2 (Kong + GoPhish API keys)
DISABLE: 0
REMOVE: 1 (test_inactive_demo cleanup correcto)
EXEMPT: 2 (controlcase_auditor + K8s viewer-prod)
Tickets generados: 1 (verificar removal controlcase_auditor 2026-08-31)
Ejecución de acciones: Completada 2026-06-16 19:58 UTC9.1 Acciones técnicas ejecutadas (audit log)
| Plataforma | SA | Acción | Comando | Timestamp UTC |
|---|---|---|---|---|
| PG staging | test_inactive_demo | REMOVE | doctl databases user delete 75917799-... test_inactive_demo --force | 2026-06-16 19:55:12 |
| Kong API | admin-key | ROTATE | kong admin-api regenerate-key + K8s Secret update | 2026-06-16 19:56:30 |
| GoPhish | api-key | ROTATE | GoPhish console → API Key → Generate New | 2026-06-16 19:57:45 |
Todas las acciones logueadas en pci_compliance.account_disable_log + Wazuh audit (Kong + GoPhish admin actions captured via Coraza WAF logs forwarded to Wazuh + Rapid7).
10. Excepciones (EXEMPT) con fecha de re-revisión
| # | SA | Plataforma | Razón | Próxima evaluación |
|---|---|---|---|---|
| 1 | controlcase_auditor | PG prod | QSA temporary access | 2026-08-31 (removal scheduled) |
| 2 | viewer-prod | K8s rbac-sod | RBAC slot for auditors | Q3 2026 cycle |
11. ACK del CTO
Yo, Gabriel Ureña, CTO de Fintrixs SAS, confirmo que:
He revisado personalmente cada uno de los 29 service accounts listados en este informe, extraídos vía
doctl,kubectl,gh,psql, ywazuh-securityadminel 2026-06-16.He validado que el acceso de cada SA sigue siendo apropiado a la función del sistema o aplicación que lo consume:
- DB primary (2): required by DBaaS, no alternative
- K8s cluster-admin (2): required for ops + CI/CD
- App production SA (16): cada uno tiene workload activo identificado
- Read-only (1): used by reports
- Infra tokens (2): used by daily ops + CI/CD
- Vendor SA (3): rotated post-Q45; vendor active
- Compensating control (3): rotated en este ciclo
Ningún SA es "orphan" — todos tienen sistema consumidor identificado y verificado.
He aplicado las acciones de ROTATE (Kong + GoPhish API keys) y REMOVE (test_inactive_demo cleanup). Ambas verificadas técnicamente.
Las 2 excepciones (EXEMPT) tienen fecha de re-evaluación:
controlcase_auditor→ removal 2026-08-31viewer-prodSA → re-eval Q3 2026Firma: Gabriel Ureña (digitalmente firmado vía git signed commit)
Fecha: 2026-06-16T19:58:00Z
12. ACK del CISO
Yo, Gabriel Ureña (acting CISO), confirmo que:
He revisado el informe del CTO y las decisiones tomadas.
He validado que TRA-001 v1.0 sigue siendo apropiado — sin cambios significativos en arquitectura que disparen re-evaluación del TRA (próxima revisión obligatoria del TRA: 2027-06-16).
He verificado en una muestra del 100% (single-person org → no sampling) que cada SA tiene sistema consumidor activo identificado.
Firma: Gabriel Ureña (acting CISO)
Fecha: 2026-06-16T19:59:00Z
13. Próximo ciclo Q3 2026
| Hito | Fecha |
|---|---|
| Recordatorio inicio | 2026-09-01 09:00 UTC |
| Deadline | 2026-09-30 23:59 UTC |
| Tickets carry-over | Re-eval viewer-prod K8s SA; verificar removal controlcase_auditor (debió ser 2026-08-31) |
14. Apéndice — Comandos de extracción reproducibles
bash
# Cat A + C + D + F · PostgreSQL users
doctl databases user list 061abee8-1d2c-49f4-be08-55f0054288cb --format Name,Role
doctl databases user list 75917799-1bf3-4cc3-85d6-71b9dba38e3d --format Name,Role
# Cat B + C · K8s ServiceAccounts
kubectl --context do-nyc1-fintrix-production-k8s get sa --all-namespaces
# Cat E · DigitalOcean PATs
doctl auth list
# Cat E · GitHub Apps
gh api orgs/Fintrixs-SAS/installations --jq '.installations[] | "\(.app_slug) \(.account.login)"'
# Cat F · Wazuh internal users
kubectl -n wazuh exec wazuh-indexer-0 -- bash -c \
"JAVA_HOME=/usr/share/wazuh-indexer/jdk \
/usr/share/wazuh-indexer/plugins/opensearch-security/tools/securityadmin.sh \
-nhnv -backup /tmp/snap"
yq '.[] | select(.reserved == false)' /tmp/snap/internal_users.yml
# Cat G · Compensating control SAs (rotate quarterly)
# Kong admin key
kubectl --context do-nyc1-fintrix-production-k8s -n default \
get secret kong-admin-key -o jsonpath='{.data.key}' | base64 -d
# GoPhish API key
docker exec gophish sqlite3 /opt/gophish/gophish.db \
"SELECT api_key FROM users WHERE username='admin'"