| CCC.IAM.CN01 | Restrict IAM User Credentials Creation | Prevent non-administrative principals from creating new long-lived credentials like access keys or generating temporary session tokens. This blocks a common privilege escalation and persistence vector. | Access Control | 1 | 5 | 2 |
| CCC.IAM.CN02 | Restrict IAM Policies Modification | Ensure that only designated administrative accounts have the ability to create, modify, or attach policies that define permissions for other identities. | Access Control | 1 | 5 | 2 |
| CCC.IAM.CN03 | Restrict Role Assumption / Delegation | Limit which principals can assume a role or impersonate a service identity, and which roles a principal may pass to a resource, to only those required. This prevents unintended cross-account or public access by securing the "who can act as this identity" boundary. | Access Control | 3 | 5 | 4 |
| CCC.IAM.CN04 | Restrict Wildcard Usage in IAM Policies | Limit the use of wildcard permissions in IAM policies to prevent overly broad access from being granted by default. | Access Control | 2 | 4 | 1 |
| CCC.IAM.CN05 | Strong Password Policies for IAM Users | Ensure that the password policies for IAM users have strong configurations. | Access Control | 1 | 4 | 1 |
| CCC.IAM.CN06 | Maximum Age for Long-Term Static Credentials | Ensure that long-lived static credentials like access keys are programmatically rotated within a defined time period to limit the window of opportunity if compromised. | Access Control | 2 | 2 | 1 |
| CCC.IAM.CN07 | Automate Identity De-provisioning | Ensure that when an identity is terminated in the central Identity Provider (IdP), its corresponding access to cloud resources is revoked automatically. | Access Control | 2 | 2 | 2 |
| CCC.IAM.CN08 | Maximum Age for Unused Credentials | Ensure that unused IAM credentials are removed to reduce exposure in the event of potential compromise. | Access Control | 2 | 2 | 1 |
| CCC.IAM.CN09 | Enforce Federated Single Sign-On (SSO) for Human Users | Ensure that all human users must authenticate through a central, federated Identity Provider (IdP) to access the cloud environment. This eliminates cloud-native user accounts with long-lived passwords, centralizes authentication controls, and simplifies lifecycle management. | Access Control | 2 | 2 | 1 |
| CCC.IAM.CN10 | Alert On Anomalous Behaviour | Ensure that logs and associated alerts are generated when anomalous API requests are made by a single identity, such as API requests commonly associated with privilege escalation tactics, originating from an external or malicious IP address or performed by a previously dormant identity, which may indicate that credentials may be compromised, as well as for password brute-force attempts and account lockouts. | Observability | 1 | 6 | 2 |
| CCC.IAM.CN11 | Enable Continuous IAM Access and Usage Analysis | Enable and configure the cloud provider's native access and usage analysis services to continuously monitor for external access paths and internal unused access. | Observability | 5 | 5 | 2 |
| CCC.IAM.CN12 | Restrict IAM Role Creation | Ensure that only designated administrative principals can create roles or service identities, closing a persistence and privilege escalation path. | Access Control | 1 | 3 | 2 |
| CCC.IAM.CN13 | Enforce Multi-Factor Authentication for Human Identities | Ensure that no human identity can authenticate to the cloud environment with a single factor, so that a compromised password alone grants no access. | Access Control | 2 | 2 | 2 |