Unused IAM identity that is no longer needed or monitored remains active. Its compromise is less likely to be detected, and it represents a persistent, unnecessary attack surface.
Unused Credentials Remain Active
CCC.IAM.TH11
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CP02 | IAM Users | The service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform. |
| CCC.IAM.CP03 | Long-Term Credentials | The service can issue long-term credentials, such as access keys, client secrets or service account keys, that remain valid until they are deleted or expire. |
| CCC.IAM.CP04 | Password Management | The service can set, change and reset passwords for user identities, and may be configured with a password policy that enforces complexity, history and expiry requirements. |
| CCC.IAM.CP06 | IAM Roles and Service Principals | The service can create, list, modify and delete roles or service principals, which are identities that applications and services use to access resources without a human user. |
| CCC.IAM.CP18 | Audit Tooling | The service can simulate or analyze the permissions an identity holds or has used, and can report which identities have access to a resource and whether that access is exercised. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CN08 | Maximum Age for Unused Credentials | Ensure that unused IAM credentials are removed to reduce exposure in the event of potential compromise. |
| CCC.IAM.CN11 | Enable Continuous IAM Access and Usage Analysis | Enable and configure the cloud provider's native access and usage analysis services to continuously monitor for external access paths and internal unused access. |