Identity / IAM / Controls / v2026.11
Automate Identity De-provisioning
CCC.IAM.CN07 · Access Control
Ensure that when an identity is terminated in the central Identity Provider (IdP), its corresponding access to cloud resources is revoked automatically.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.IAM.CP08 | Federated Identity - SAML | The service may be configured to trust an external identity provider using SAML 2.0, so that users authenticated by that provider can obtain cloud credentials or assume roles. |
| CCC.IAM.CP09 | Federated Identity - OIDC | The service may be configured to trust an external identity provider using OpenID Connect, so that users or workloads authenticated by that provider can obtain cloud credentials or assume roles. |
| CCC.IAM.CP01 | Global Identities | The service always manages identities in a single global namespace, so an identity and its credentials are valid in every region without regional configuration. |
| CCC.IAM.CP02 | IAM Users | The service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform. |
| CCC.IAM.CP03 | Long-Term Credentials | The service can issue long-term credentials, such as access keys, client secrets or service account keys, that remain valid until they are deleted or expire. |
| CCC.IAM.CP04 | Password Management | The service can set, change and reset passwords for user identities, and may be configured with a password policy that enforces complexity, history and expiry requirements. |
| CCC.IAM.CP07 | Managed Identities | The service can assign an identity to a child resource such as a virtual machine or function, and automatically manages and rotates that identity's credentials. |
| CCC.IAM.CP13 | Temporary Credentials | The service can issue short-lived credentials for a session or task that expire automatically after a defined duration. |
Related Threats
| ID | Title | Description |
|---|
| CCC.IAM.TH10 | Orphaned Federated Identity Retains Access | A federated identity is de-provisioned from the external Identity Provider (IdP), but its corresponding cloud identity remains active within the cloud environment. This orphaned identity creates a latent access path that could be exploited if the original username is reactivated or reassigned in the IdP, granting unintended access to a new principal. |
| CCC.IAM.TH01 | Valid Cloud Credentials Abuse | Valid identity credentials such as access keys, tokens or passwords are misused or compromised. Examples include public exposure, token theft, unprotected metadata service of a compromised compute instance or brute-force attacks. The use of these credentials can provide unauthorized access to the cloud environment, potentially bypassing other security controls and enabling lateral movement across cloud resources. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.IAM.CN07.AR01 | When a user account is disabled or deleted in the organization's IdP, the corresponding cloud identity MUST be disabled or deleted within 24 hours. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.IAM.CN07.AR02 | When a user account is disabled or deleted in the organization's IdP, the access policies attached to the corresponding cloud identity MUST be detached or deleted within 24 hours. | tlp-clear, tlp-green, tlp-amber, tlp-red |