The service can create, list, modify and delete user-defined roles that specify exactly which actions are permitted, in addition to the roles the provider defines.
Custom Roles
CCC.IAM.CP10
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.IAM.TH02 | Overly-Permissive IAM Policy | An access control policy attached to an identity or a resource is configured with excessive permissions, violating the principle of least privilege. This can enable unauthorized data access, privilege escalation, or other unintended actions by principals whose credentials might be compromised or who are acting erroneously. |
| CCC.IAM.TH05 | Roles are Created Without Authorization | A principal holds permissions to create roles or service identities beyond what its function requires, or a compromised identity holds such permissions. Additional roles are then created outside the organization's provisioning process, each with its own trust policy and permissions, and remain available after the originating access ends. This compromises the integrity of the access model and the confidentiality of the resources those roles can reach. |
| CCC.IAM.TH06 | IAM Policies are Modified Without Authorization | A principal holds permissions to create, update or attach IAM policies beyond what its function requires, or a compromised identity holds such permissions. Policies are then modified outside the organization's change process so that identities gain permissions they were not granted by design, and the change persists until it is detected. This compromises the integrity of the access model and the confidentiality and integrity of the resources the widened permissions reach. |
| CCC.IAM.TH12 | IAM Role is Coerced into Unauthorized Cross-Account Actions (Confused Deputy) | An external actor tricks a legitimate, authorized third-party application into making requests to the cloud environment. A role in the cloud account (the "deputy"), which trusts that third-party application, then performs unauthorized actions on behalf of the actor. |