What it means
Data-plane access may occur through application endpoints, storage APIs, database queries, message services, analytics tools, and service-to-service calls.
Why it matters
Management-plane controls can be strong while data-plane permissions remain overly broad or invisible. Both planes need distinct authorization, telemetry, and threat models.
Practical focus
- Define who and what may perform each data action
- Use service and workload identities with narrow scope
- Enable data-access logging for sensitive services
- Monitor unusual volume, destinations, and access patterns
Common mistakes
- Assuming resource creation rights and data rights are the same
- Logging configuration changes but not sensitive reads
- Granting applications broad account-level data access
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: