Long-lived static credentials such as access keys for an identity are used and not rotated periodically according to security best practices, extending exposure in the event of credentials compromise.
Static Credentials Outlive Their Rotation Period
CCC.IAM.TH09
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CP02 | IAM Users | The service can create, list, modify and delete user identities, each representing a single person or application that authenticates directly to the provider's identity platform. |
| CCC.IAM.CP03 | Long-Term Credentials | The service can issue long-term credentials, such as access keys, client secrets or service account keys, that remain valid until they are deleted or expire. |
| CCC.IAM.CP19 | Long-Term Credential Expiry | The service may be configured to set a maximum lifetime on a long-term credential so that it stops working automatically once that lifetime is reached. On providers without this feature for a credential type, the credential remains valid until it is rotated or deleted. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CN06 | Maximum Age for Long-Term Static Credentials | Ensure that long-lived static credentials like access keys are programmatically rotated within a defined time period to limit the window of opportunity if compromised. |
| CCC.IAM.CN09 | Enforce Federated Single Sign-On (SSO) for Human Users | Ensure that all human users must authenticate through a central, federated Identity Provider (IdP) to access the cloud environment. This eliminates cloud-native user accounts with long-lived passwords, centralizes authentication controls, and simplifies lifecycle management. |