Identity / IAM / Controls / v2026.11
Restrict IAM Role Creation
CCC.IAM.CN12 · Access Control
Ensure that only designated administrative principals can create roles or service identities, closing a persistence and privilege escalation path.
Related Capabilities
| ID | Title | Description |
|---|
| CCC.IAM.CP06 | IAM Roles and Service Principals | The service can create, list, modify and delete roles or service principals, which are identities that applications and services use to access resources without a human user. |
| CCC.IAM.CP10 | Custom Roles | The service can create, list, modify and delete user-defined roles that specify exactly which actions are permitted, in addition to the roles the provider defines. |
| CCC.IAM.CP15 | Role Assumption and Delegation | The service can allow an authenticated principal to temporarily assume another role or impersonate a service identity, obtaining that identity's permissions for a limited session. |
Related Threats
| ID | Title | Description |
|---|
| CCC.IAM.TH05 | Roles are Created Without Authorization | A principal holds permissions to create roles or service identities beyond what its function requires, or a compromised identity holds such permissions. Additional roles are then created outside the organization's provisioning process, each with its own trust policy and permissions, and remain available after the originating access ends. This compromises the integrity of the access model and the confidentiality of the resources those roles can reach. |
Assessment Requirements
| ID | Text | Applicability |
|---|
| CCC.IAM.CN12.AR01 | When an identity policy for a non-administrative principal is evaluated, it MUST NOT grant permissions for creating roles or service identities. | tlp-clear, tlp-green, tlp-amber, tlp-red |
| CCC.IAM.CN12.AR02 | When a non-administrative principal attempts to create a role or service identity, the service MUST deny the action. | tlp-clear, tlp-green, tlp-amber, tlp-red |