An access control policy attached to an identity or a resource is configured with excessive permissions, violating the principle of least privilege. This can enable unauthorized data access, privilege escalation, or other unintended actions by principals whose credentials might be compromised or who are acting erroneously.
Overly-Permissive IAM Policy
CCC.IAM.TH02
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CP02 | IAM Users | The service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform. |
| CCC.IAM.CP05 | IAM Groups | The service can create, list, modify and delete groups of identities so that permissions assigned to the group apply to every member. |
| CCC.IAM.CP06 | IAM Roles and Service Principals | The service can create, list, modify and delete roles or service principals, which are identities that applications and services use to access resources without a human user. |
| CCC.IAM.CP07 | Managed Identities | The service can assign an identity to a child resource such as a virtual machine or function, and automatically manages and rotates that identity's credentials. |
| CCC.IAM.CP10 | Custom Roles | The service can create, list, modify and delete user-defined roles that specify exactly which actions are permitted, in addition to the roles the provider defines. |
| CCC.IAM.CP11 | Resource-Level Access | The service can scope a permission grant to specific resources or resource hierarchies rather than to the entire service. |
| CCC.IAM.CP12 | Policy Conditions | The service can attach conditions to a permission grant so that the grant applies only when attributes of the request, principal or resource match. |
| CCC.IAM.CP17 | Deny Permissions by Default | The service always denies access to every resource unless a permission has been explicitly granted to the requesting identity. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CN04 | Restrict Wildcard Usage in IAM Policies | Limit the use of wildcard permissions in IAM policies to prevent overly broad access from being granted by default. |
| CCC.IAM.CN11 | Enable Continuous IAM Access and Usage Analysis | Enable and configure the cloud provider's native access and usage analysis services to continuously monitor for external access paths and internal unused access. |