Identity / IAM / Controls / v2026.11
Restrict IAM User Credentials Creation
CCC.IAM.CN01 · Access Control
Prevent non-administrative principals from creating new long-lived credentials like access keys or generating temporary session tokens. This blocks a common privilege escalation and persistence vector.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.IAM.CP02 | IAM Users | The service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform. |
| CCC.IAM.CP03 | Long-Term Credentials | The service can issue long-term credentials, such as access keys, client secrets or service account keys, that remain valid until they are deleted or expire. |
| CCC.IAM.CP04 | Password Management | The service can set, change and reset passwords for user identities, and may be configured with a password policy that enforces complexity, history and expiry requirements. |
| CCC.IAM.CP08 | Federated Identity - SAML | The service may be configured to trust an external identity provider using SAML 2.0, so that users authenticated by that provider can obtain cloud credentials or assume roles. |
| CCC.IAM.CP09 | Federated Identity - OIDC | The service may be configured to trust an external identity provider using OpenID Connect, so that users or workloads authenticated by that provider can obtain cloud credentials or assume roles. |
| CCC.IAM.CP13 | Temporary Credentials | The service can issue short-lived credentials for a session or task that expire automatically after a defined duration. |
Related Threats
| ID | Title | Description |
|---|
| CCC.IAM.TH04 | Credentials are Created Without Authorization | A principal holds permissions to create credentials, such as access keys, service account keys, client secrets or session tokens, beyond what its function requires, or a compromised identity holds such permissions. Additional credentials are then created outside the organization's provisioning process and remain valid after the originating access ends. This compromises the integrity of the access model and the confidentiality of every resource the new credentials can reach. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.IAM.CN01.AR01 | When an identity policy for a non-administrative principal is evaluated, it MUST NOT grant permissions for creating credentials or generating temporary session tokens. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.IAM.CN01.AR02 | When a non-administrative principal attempts to create new credentials or a temporary session token, the service MUST deny the action. | tlp-clear, tlp-green, tlp-amber, tlp-red |