Ensure that all human users must authenticate through a central, federated Identity Provider (IdP) to access the cloud environment. This eliminates cloud-native user accounts with long-lived passwords, centralizes authentication controls, and simplifies lifecycle management.
Enforce Federated Single Sign-On (SSO) for Human Users
CCC.IAM.CN09 · Access Control
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CP01 | Global Identities | The service always manages identities in a single global namespace, so an identity and its credentials are valid in every region without regional configuration. |
| CCC.IAM.CP02 | IAM Users | The service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform. |
| CCC.IAM.CP03 | Long-Term Credentials | The service can issue long-term credentials, such as access keys, client secrets or service account keys, that remain valid until they are deleted or expire. |
| CCC.IAM.CP04 | Password Management | The service can set, change and reset passwords for user identities, and may be configured with a password policy that enforces complexity, history and expiry requirements. |
| CCC.IAM.CP07 | Managed Identities | The service can assign an identity to a child resource such as a virtual machine or function, and automatically manages and rotates that identity's credentials. |
| CCC.IAM.CP08 | Federated Identity - SAML | The service may be configured to trust an external identity provider using SAML 2.0, so that users authenticated by that provider can obtain cloud credentials or assume roles. |
| CCC.IAM.CP09 | Federated Identity - OIDC | The service may be configured to trust an external identity provider using OpenID Connect, so that users or workloads authenticated by that provider can obtain cloud credentials or assume roles. |
| CCC.IAM.CP13 | Temporary Credentials | The service can issue short-lived credentials for a session or task that expire automatically after a defined duration. |
| CCC.IAM.CP19 | Long-Term Credential Expiry | The service may be configured to set a maximum lifetime on a long-term credential so that it stops working automatically once that lifetime is reached. On providers without this feature for a credential type, the credential remains valid until it is rotated or deleted. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.IAM.TH01 | Valid Cloud Credentials Abuse | Valid identity credentials such as access keys, tokens or passwords are misused or compromised. Examples include public exposure, token theft, unprotected metadata service of a compromised compute instance or brute-force attacks. The use of these credentials can provide unauthorized access to the cloud environment, potentially bypassing other security controls and enabling lateral movement across cloud resources. |
| CCC.IAM.TH09 | Static Credentials Outlive Their Rotation Period | Long-lived static credentials such as access keys for an identity are used and not rotated periodically according to security best practices, extending exposure in the event of credentials compromise. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.IAM.CN09.AR01 | When a human user accesses the cloud environment, they MUST authenticate through the organization's federated IdP via a standard protocol (e.g., SAML, OIDC). | tlp-clear, tlp-green, tlp-amber, tlp-red |