Skip to main content

Identity / IAM / Controls / v2026.11

Restrict Wildcard Usage in IAM Policies

CCC.IAM.CN04 · Access Control

Limit the use of wildcard permissions in IAM policies to prevent overly broad access from being granted by default.

Related Capabilities

IDTitleDescription
CCC.IAM.CP01Global IdentitiesThe service always manages identities in a single global namespace, so an identity and its credentials are valid in every region without regional configuration.
CCC.IAM.CP02IAM UsersThe service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform.
CCC.IAM.CP03Long-Term CredentialsThe service can issue long-term credentials, such as access keys, client secrets or service account keys, that remain valid until they are deleted or expire.
CCC.IAM.CP04Password ManagementThe service can set, change and reset passwords for user identities, and may be configured with a password policy that enforces complexity, history and expiry requirements.
CCC.IAM.CP07Managed IdentitiesThe service can assign an identity to a child resource such as a virtual machine or function, and automatically manages and rotates that identity's credentials.
CCC.IAM.CP08Federated Identity - SAMLThe service may be configured to trust an external identity provider using SAML 2.0, so that users authenticated by that provider can obtain cloud credentials or assume roles.
CCC.IAM.CP09Federated Identity - OIDCThe service may be configured to trust an external identity provider using OpenID Connect, so that users or workloads authenticated by that provider can obtain cloud credentials or assume roles.
CCC.IAM.CP13Temporary CredentialsThe service can issue short-lived credentials for a session or task that expire automatically after a defined duration.
CCC.IAM.CP05IAM GroupsThe service can create, list, modify and delete groups of identities so that permissions assigned to the group apply to every member.
CCC.IAM.CP06IAM Roles and Service PrincipalsThe service can create, list, modify and delete roles or service principals, which are identities that applications and services use to access resources without a human user.
CCC.IAM.CP10Custom RolesThe service can create, list, modify and delete user-defined roles that specify exactly which actions are permitted, in addition to the roles the provider defines.
CCC.IAM.CP11Resource-Level AccessThe service can scope a permission grant to specific resources or resource hierarchies rather than to the entire service.
CCC.IAM.CP12Policy ConditionsThe service can attach conditions to a permission grant so that the grant applies only when attributes of the request, principal or resource match.
CCC.IAM.CP17Deny Permissions by DefaultThe service always denies access to every resource unless a permission has been explicitly granted to the requesting identity.

Related Threats

IDTitleDescription
CCC.IAM.TH01Valid Cloud Credentials AbuseValid identity credentials such as access keys, tokens or passwords are misused or compromised. Examples include public exposure, token theft, unprotected metadata service of a compromised compute instance or brute-force attacks. The use of these credentials can provide unauthorized access to the cloud environment, potentially bypassing other security controls and enabling lateral movement across cloud resources.
CCC.IAM.TH02Overly-Permissive IAM PolicyAn access control policy attached to an identity or a resource is configured with excessive permissions, violating the principle of least privilege. This can enable unauthorized data access, privilege escalation, or other unintended actions by principals whose credentials might be compromised or who are acting erroneously.

Assessment Requirements

IDTextApplicability
CCC.IAM.CN04.AR01When an IAM policy is created or updated, it MUST NOT contain allow statements with wildcard permissions, unless the statement is restricted by a condition.tlp-green, tlp-amber, tlp-red

Guideline Mappings

FrameworkIDRemarks
NIST-CSFPR.AC-6
NIST_800_53AC-2
NIST_800_53AC-3
NIST_800_53AC-6