Identity / IAM

Controls

Version:

ID	Title	Objective
CCC.IAM.CN01	Restrict IAM User Credentials Creation	Prevent non-administrative principals from creating new long-lived credentials like access keys or generating temporary session tokens. This blocks a common privilege escalation and persistence vector.
CCC.IAM.CN02	Restrict IAM Policies Modification	Ensure that only designated administrative accounts have the ability to create, modify, or attach policies that define permissions for other identities.
CCC.IAM.CN03	Restrict Role Assumption / Delegation	Limit which principals can assume a role or impersonate a service identity to only those required. This prevents unintended cross-account or public access by securing the "who can act as this identity" boundary.
CCC.IAM.CN04	Restrict Wildcard Usage in IAM Policies	Limit the use of wildcard permissions in IAM policies to prevent overly broad access from being granted by default.
CCC.IAM.CN05	Strong Password Policies for IAM Users	Ensure that the password policies for IAM users have strong configurations.
CCC.IAM.CN06	Maximum Age for Long-Term Static Credentials	Ensure that long-lived static credentials like access keys are programmatically rotated within a defined time period to limit the window of opportunity if compromised.
CCC.IAM.CN07	Automate Identity De-provisioning	Ensure that when an identity is terminated in the central Identity Provider (IdP), ts corresponding access to cloud resources is revoked automatically.
CCC.IAM.CN08	Maximum Age for Unused Credentials	Ensure that unused IAM credentals are removed to reduce exposure in the event of potential compromise.
CCC.IAM.CN09	Enforce Federated Single Sign-On (SSO) for Human Users	Ensure that all human users must authenticate through a central, federated Identity Provider (IdP) to access the cloud environment. This eliminates cloud-native user accounts with long-lived passwords, centralizes authentication controls, and simplifies lifecycle management.
CCC.IAM.CN10	Alert On Anomalous Behaviour	Ensure that logs and associated alerts are generated when anomalous API requests are made by a single identity, such as API requests commonly associated with privilege escalation tactics, originating from an external or malicious IP address or performed by a previously dormant identity, which may indicate that credentals may be compromised, as well as for password brute-force attempts and account lockouts.
CCC.IAM.CN11	Enable Continuous IAM Access and Usage Analysis	Enable and configure the cloud provider's native access and usage analysis services to continuously monitor for external access paths and internal unused access.