Identity / IAM / Controls / v2026.11
Restrict IAM Policies Modification
CCC.IAM.CN02 · Access Control
Ensure that only designated administrative accounts have the ability to create, modify, or attach policies that define permissions for other identities.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.IAM.CP02 | IAM Users | The service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform. |
| CCC.IAM.CP06 | IAM Roles and Service Principals | The service can create, list, modify and delete roles or service principals, which are identities that applications and services use to access resources without a human user. |
| CCC.IAM.CP10 | Custom Roles | The service can create, list, modify and delete user-defined roles that specify exactly which actions are permitted, in addition to the roles the provider defines. |
| CCC.IAM.CP16 | Access Boundaries | The service may be configured with a boundary that caps the maximum effective permissions an identity can hold, regardless of the permissions granted to it. On providers without this feature, delegated permission grants have no upper bound. |
Related Threats
| ID | Title | Description |
|---|
| CCC.IAM.TH06 | IAM Policies are Modified Without Authorization | A principal holds permissions to create, update or attach IAM policies beyond what its function requires, or a compromised identity holds such permissions. Policies are then modified outside the organization's change process so that identities gain permissions they were not granted by design, and the change persists until it is detected. This compromises the integrity of the access model and the confidentiality and integrity of the resources the widened permissions reach. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.IAM.CN02.AR01 | When an identity policy for a non-administrative principal is evaluated, it MUST NOT grant permissions for creating, updating, or attaching policies. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.IAM.CN02.AR02 | When a non-administrative principal attempts to create, update, or attach policies, the service MUST deny the action. | tlp-clear, tlp-green, tlp-amber, tlp-red |