| CCC.IAM.TH01 | Valid Cloud Credentials Abuse | Valid identity credentials such as access keys, tokens or passwords are misused or compromised. Examples include public exposure, token theft, unprotected metadata service of a compromised compute instance or brute-force attacks. The use of these credentials can provide unauthorized access to the cloud environment, potentially bypassing other security controls and enabling lateral movement across cloud resources. | 0 | 1 | 7 |
| CCC.IAM.TH02 | Overly-Permissive IAM Policy | An access control policy attached to an identity or a resource is configured with excessive permissions, violating the principle of least privilege. This can enable unauthorized data access, privilege escalation, or other unintended actions by principals whose credentials might be compromised or who are acting erroneously. | 0 | 1 | 2 |
| CCC.IAM.TH03 | Overly-Permissive Identity Trust Policy | An IAM role or service principal's trust policy is configured to allow principals from untrusted or overly broad scopes, such as any identity in any account, to assume or impersonate it. This can allow an external or unauthorized identity to gain access to the cloud environment, completely bypassing internal identity controls. | 0 | 1 | 2 |
| CCC.IAM.TH04 | Credentials are Created Without Authorization | A principal holds permissions to create credentials, such as access keys, service account keys, client secrets or session tokens, beyond what its function requires, or a compromised identity holds such permissions. Additional credentials are then created outside the organization's provisioning process and remain valid after the originating access ends. This compromises the integrity of the access model and the confidentiality of every resource the new credentials can reach. | 0 | 1 | 1 |
| CCC.IAM.TH05 | Roles are Created Without Authorization | A principal holds permissions to create roles or service identities beyond what its function requires, or a compromised identity holds such permissions. Additional roles are then created outside the organization's provisioning process, each with its own trust policy and permissions, and remain available after the originating access ends. This compromises the integrity of the access model and the confidentiality of the resources those roles can reach. | 0 | 1 | 1 |
| CCC.IAM.TH06 | IAM Policies are Modified Without Authorization | A principal holds permissions to create, update or attach IAM policies beyond what its function requires, or a compromised identity holds such permissions. Policies are then modified outside the organization's change process so that identities gain permissions they were not granted by design, and the change persists until it is detected. This compromises the integrity of the access model and the confidentiality and integrity of the resources the widened permissions reach. | 0 | 1 | 1 |
| CCC.IAM.TH07 | Identity Inherits Excessive Permissions Through Group Membership | An identity principal becomes a member of one or more IAM groups, and the combined policies of these groups grant permissions beyond what is necessary for the principal's function. This "privilege creep" through group inheritance complicates auditing and can lead to an identity having standing access to sensitive resources. | 0 | 1 | 1 |
| CCC.IAM.TH08 | Privilege Escalation via Indirect Role Usage | An identity principal possesses specific, highly privileged permissions, such as the ability to pass roles or impersonate service accounts, that allow it to leverage the permissions of a different, more privileged role. Even without being able to directly assume the target role, the principal can attach it to a new resource they control and then use that resource to perform unauthorized actions. | 0 | 1 | 1 |
| CCC.IAM.TH09 | Static Credentials Outlive Their Rotation Period | Long-lived static credentials such as access keys for an identity are used and not rotated periodically according to security best practices, extending exposure in the event of credentials compromise. | 0 | 1 | 2 |
| CCC.IAM.TH10 | Orphaned Federated Identity Retains Access | A federated identity is de-provisioned from the external Identity Provider (IdP), but its corresponding cloud identity remains active within the cloud environment. This orphaned identity creates a latent access path that could be exploited if the original username is reactivated or reassigned in the IdP, granting unintended access to a new principal. | 0 | 1 | 2 |
| CCC.IAM.TH11 | Unused Credentials Remain Active | Unused IAM identity that is no longer needed or monitored remains active. Its compromise is less likely to be detected, and it represents a persistent, unnecessary attack surface. | 0 | 1 | 2 |
| CCC.IAM.TH12 | IAM Role is Coerced into Unauthorized Cross-Account Actions (Confused Deputy) | An external actor tricks a legitimate, authorized third-party application into making requests to the cloud environment. A role in the cloud account (the "deputy"), which trusts that third-party application, then performs unauthorized actions on behalf of the actor. | 0 | 1 | 1 |
| CCC.IAM.TH13 | Multi-Factor Authentication is Not Enforced | MFA enforcement may be left unconfigured or disabled for an identity, or a sign-in may be allowed to complete with a single factor. A password or token obtained through phishing, leakage or brute force is then sufficient to authenticate as that identity. This results in a loss of confidentiality of the resources the identity can read and of integrity where it can write. | 0 | 1 | 1 |