An identity principal becomes a member of one or more IAM groups, and the combined policies of these groups grant permissions beyond what is necessary for the principal's function. This "privilege creep" through group inheritance complicates auditing and can lead to an identity having standing access to sensitive resources.
Identity Inherits Excessive Permissions Through Group Membership
CCC.IAM.TH07
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CP05 | IAM Groups | The service can create, list, modify and delete groups of identities so that permissions assigned to the group apply to every member. |
| CCC.IAM.CP18 | Audit Tooling | The service can simulate or analyze the permissions an identity holds or has used, and can report which identities have access to a resource and whether that access is exercised. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CN11 | Enable Continuous IAM Access and Usage Analysis | Enable and configure the cloud provider's native access and usage analysis services to continuously monitor for external access paths and internal unused access. |