Skip to main content

Identity / IAM / Controls / v2026.11

Enable Continuous IAM Access and Usage Analysis

CCC.IAM.CN11 · Observability

Enable and configure the cloud provider's native access and usage analysis services to continuously monitor for external access paths and internal unused access.

Related Capabilities

IDTitleDescription
CCC.IAM.CP02IAM UsersThe service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform.
CCC.IAM.CP05IAM GroupsThe service can create, list, modify and delete groups of identities so that permissions assigned to the group apply to every member.
CCC.IAM.CP06IAM Roles and Service PrincipalsThe service can create, list, modify and delete roles or service principals, which are identities that applications and services use to access resources without a human user.
CCC.IAM.CP07Managed IdentitiesThe service can assign an identity to a child resource such as a virtual machine or function, and automatically manages and rotates that identity's credentials.
CCC.IAM.CP10Custom RolesThe service can create, list, modify and delete user-defined roles that specify exactly which actions are permitted, in addition to the roles the provider defines.
CCC.IAM.CP11Resource-Level AccessThe service can scope a permission grant to specific resources or resource hierarchies rather than to the entire service.
CCC.IAM.CP12Policy ConditionsThe service can attach conditions to a permission grant so that the grant applies only when attributes of the request, principal or resource match.
CCC.IAM.CP17Deny Permissions by DefaultThe service always denies access to every resource unless a permission has been explicitly granted to the requesting identity.
CCC.IAM.CP08Federated Identity - SAMLThe service may be configured to trust an external identity provider using SAML 2.0, so that users authenticated by that provider can obtain cloud credentials or assume roles.
CCC.IAM.CP09Federated Identity - OIDCThe service may be configured to trust an external identity provider using OpenID Connect, so that users or workloads authenticated by that provider can obtain cloud credentials or assume roles.
CCC.IAM.CP15Role Assumption and DelegationThe service can allow an authenticated principal to temporarily assume another role or impersonate a service identity, obtaining that identity's permissions for a limited session.
CCC.IAM.CP18Audit ToolingThe service can simulate or analyze the permissions an identity holds or has used, and can report which identities have access to a resource and whether that access is exercised.
CCC.IAM.CP03Long-Term CredentialsThe service can issue long-term credentials, such as access keys, client secrets or service account keys, that remain valid until they are deleted or expire.
CCC.IAM.CP04Password ManagementThe service can set, change and reset passwords for user identities, and may be configured with a password policy that enforces complexity, history and expiry requirements.

Related Threats

IDTitleDescription
CCC.IAM.TH02Overly-Permissive IAM PolicyAn access control policy attached to an identity or a resource is configured with excessive permissions, violating the principle of least privilege. This can enable unauthorized data access, privilege escalation, or other unintended actions by principals whose credentials might be compromised or who are acting erroneously.
CCC.IAM.TH03Overly-Permissive Identity Trust PolicyAn IAM role or service principal's trust policy is configured to allow principals from untrusted or overly broad scopes, such as any identity in any account, to assume or impersonate it. This can allow an external or unauthorized identity to gain access to the cloud environment, completely bypassing internal identity controls.
CCC.IAM.TH07Identity Inherits Excessive Permissions Through Group MembershipAn identity principal becomes a member of one or more IAM groups, and the combined policies of these groups grant permissions beyond what is necessary for the principal's function. This "privilege creep" through group inheritance complicates auditing and can lead to an identity having standing access to sensitive resources.
CCC.IAM.TH10Orphaned Federated Identity Retains AccessA federated identity is de-provisioned from the external Identity Provider (IdP), but its corresponding cloud identity remains active within the cloud environment. This orphaned identity creates a latent access path that could be exploited if the original username is reactivated or reassigned in the IdP, granting unintended access to a new principal.
CCC.IAM.TH11Unused Credentials Remain ActiveUnused IAM identity that is no longer needed or monitored remains active. Its compromise is less likely to be detected, and it represents a persistent, unnecessary attack surface.

Assessment Requirements

IDTextApplicability
CCC.IAM.CN11.AR01When a cloud account or organization is provisioned, the native automated access analysis service MUST be enabled to continuously monitor for external or public access to resources.tlp-clear, tlp-green, tlp-amber, tlp-red
CCC.IAM.CN11.AR02When a cloud account or organization is provisioned, the native automated usage analysis service MUST be enabled to continuously monitor for permissions that identities hold but do not use.tlp-clear, tlp-green, tlp-amber, tlp-red

Guideline Mappings

FrameworkIDRemarks
NIST-CSFID.RA-01
NIST-CSFID.IM-01
NIST_800_53AC-2
NIST_800_53CA-7
NIST_800_53RA-5