Limit which principals can assume a role or impersonate a service identity, and which roles a principal may pass to a resource, to only those required. This prevents unintended cross-account or public access by securing the "who can act as this identity" boundary.
Restrict Role Assumption / Delegation
CCC.IAM.CN03 · Access Control
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CP06 | IAM Roles and Service Principals | The service can create, list, modify and delete roles or service principals, which are identities that applications and services use to access resources without a human user. |
| CCC.IAM.CP08 | Federated Identity - SAML | The service may be configured to trust an external identity provider using SAML 2.0, so that users authenticated by that provider can obtain cloud credentials or assume roles. |
| CCC.IAM.CP09 | Federated Identity - OIDC | The service may be configured to trust an external identity provider using OpenID Connect, so that users or workloads authenticated by that provider can obtain cloud credentials or assume roles. |
| CCC.IAM.CP12 | Policy Conditions | The service can attach conditions to a permission grant so that the grant applies only when attributes of the request, principal or resource match. |
| CCC.IAM.CP15 | Role Assumption and Delegation | The service can allow an authenticated principal to temporarily assume another role or impersonate a service identity, obtaining that identity's permissions for a limited session. |
| CCC.IAM.CP02 | IAM Users | The service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform. |
| CCC.IAM.CP10 | Custom Roles | The service can create, list, modify and delete user-defined roles that specify exactly which actions are permitted, in addition to the roles the provider defines. |
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.IAM.TH03 | Overly-Permissive Identity Trust Policy | An IAM role or service principal's trust policy is configured to allow principals from untrusted or overly broad scopes, such as any identity in any account, to assume or impersonate it. This can allow an external or unauthorized identity to gain access to the cloud environment, completely bypassing internal identity controls. |
| CCC.IAM.TH08 | Privilege Escalation via Indirect Role Usage | An identity principal possesses specific, highly privileged permissions, such as the ability to pass roles or impersonate service accounts, that allow it to leverage the permissions of a different, more privileged role. Even without being able to directly assume the target role, the principal can attach it to a new resource they control and then use that resource to perform unauthorized actions. |
| CCC.IAM.TH12 | IAM Role is Coerced into Unauthorized Cross-Account Actions (Confused Deputy) | An external actor tricks a legitimate, authorized third-party application into making requests to the cloud environment. A role in the cloud account (the "deputy"), which trusts that third-party application, then performs unauthorized actions on behalf of the actor. |
Assessment Requirements
| ID | Text | Applicability |
|---|---|---|
| CCC.IAM.CN03.AR01 | When a policy is created or updated that grants a principal permission to assume a role or impersonate a service identity, the principal MUST NOT contain a wildcard or be public/anonymous. | tlp-green, tlp-amber, tlp-red |
| CCC.IAM.CN03.AR02 | When an external or unauthenticated principal tries to assume a role or impersonate a service identity, the service MUST deny the action. | tlp-green, tlp-amber, tlp-red |
| CCC.IAM.CN03.AR03 | When a policy grants a principal permission to pass or attach a role or service identity to a resource, the policy MUST name the specific roles or service identities that may be passed. | tlp-green, tlp-amber, tlp-red |
| CCC.IAM.CN03.AR04 | When a role or service identity trusts a principal from another account or an external system, the trust policy MUST require a caller-supplied identifier, such as an external ID or audience, that is unique to the trusting account. | tlp-green, tlp-amber, tlp-red |