The service may be configured with a boundary that caps the maximum effective permissions an identity can hold, regardless of the permissions granted to it. On providers without this feature, delegated permission grants have no upper bound.
Access Boundaries
CCC.IAM.CP16
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.IAM.TH06 | IAM Policies are Modified Without Authorization | A principal holds permissions to create, update or attach IAM policies beyond what its function requires, or a compromised identity holds such permissions. Policies are then modified outside the organization's change process so that identities gain permissions they were not granted by design, and the change persists until it is detected. This compromises the integrity of the access model and the confidentiality and integrity of the resources the widened permissions reach. |