A principal holds permissions to create roles or service identities beyond what its function requires, or a compromised identity holds such permissions. Additional roles are then created outside the organization's provisioning process, each with its own trust policy and permissions, and remain available after the originating access ends. This compromises the integrity of the access model and the confidentiality of the resources those roles can reach.
Roles are Created Without Authorization
CCC.IAM.TH05
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CP06 | IAM Roles and Service Principals | The service can create, list, modify and delete roles or service principals, which are identities that applications and services use to access resources without a human user. |
| CCC.IAM.CP10 | Custom Roles | The service can create, list, modify and delete user-defined roles that specify exactly which actions are permitted, in addition to the roles the provider defines. |
| CCC.IAM.CP15 | Role Assumption and Delegation | The service can allow an authenticated principal to temporarily assume another role or impersonate a service identity, obtaining that identity's permissions for a limited session. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CN12 | Restrict IAM Role Creation | Ensure that only designated administrative principals can create roles or service identities, closing a persistence and privilege escalation path. |