Identity / IAM / Controls / v2026.11
Strong Password Policies for IAM Users
CCC.IAM.CN05 · Access Control
Ensure that the password policies for IAM users have strong configurations.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.IAM.CP01 | Global Identities | The service always manages identities in a single global namespace, so an identity and its credentials are valid in every region without regional configuration. |
| CCC.IAM.CP02 | IAM Users | The service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform. |
| CCC.IAM.CP03 | Long-Term Credentials | The service can issue long-term credentials, such as access keys, client secrets or service account keys, that remain valid until they are deleted or expire. |
| CCC.IAM.CP04 | Password Management | The service can set, change and reset passwords for user identities, and may be configured with a password policy that enforces complexity, history and expiry requirements. |
| CCC.IAM.CP07 | Managed Identities | The service can assign an identity to a child resource such as a virtual machine or function, and automatically manages and rotates that identity's credentials. |
| CCC.IAM.CP08 | Federated Identity - SAML | The service may be configured to trust an external identity provider using SAML 2.0, so that users authenticated by that provider can obtain cloud credentials or assume roles. |
| CCC.IAM.CP09 | Federated Identity - OIDC | The service may be configured to trust an external identity provider using OpenID Connect, so that users or workloads authenticated by that provider can obtain cloud credentials or assume roles. |
| CCC.IAM.CP13 | Temporary Credentials | The service can issue short-lived credentials for a session or task that expire automatically after a defined duration. |
Related Threats
| ID | Title | Description |
|---|
| CCC.IAM.TH01 | Valid Cloud Credentials Abuse | Valid identity credentials such as access keys, tokens or passwords are misused or compromised. Examples include public exposure, token theft, unprotected metadata service of a compromised compute instance or brute-force attacks. The use of these credentials can provide unauthorized access to the cloud environment, potentially bypassing other security controls and enabling lateral movement across cloud resources. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.IAM.CN05.AR01 | When a new cloud account is provisioned, a password policy MUST be configured for IAM users following the minimum PCI DSS v4.0.1 configurations. | tlp-clear, tlp-green, tlp-amber, tlp-red |
Guideline Mappings
| Framework | ID | Remarks |
|---|
| NIST-CSF | PR.AA-05 | |
| NIST_800_53 | IA-5 | |
| PCI-DSS | 8.3.9 | |
| PCI-DSS | 8.6.3 | |