Skip to main content

CCC.IAM.CN02: Restrict IAM Policies Modification

Control ID:CCC.IAM.CN02
Title:Restrict IAM Policies Modification
Objective:Ensure that only designated administrative accounts have the ability to create, modify, or attach policies that define permissions for other identities.
Control Family:
Identity and Access Management

Related Threats

IDTitleDescriptionExternal MappingsCapability MappingsControl Mappings
CCC.IAM.TH06IAM Policies ModificationAn adversary with access to a sufficiently privileged cloud account may modify IAM policies to establish persistance or elevate their privileges.
1
1
0

Related Capabilities

IDTitleDescription
CCC.IAM.CP02IAM UsersAbility to create, manage, list and delete IAM users. IAM user represents a single person or application.
CCC.IAM.CP06IAM Roles / Service PrincipalsAbility to create, manage, list and delete IAM roles. IAM role is an identity for applications or services to access resources.
CCC.IAM.CP10Custom RolesAbility to create, manage, list and delete custom roles. Custom roles are user-defined roles that defines what actions are allowed.

Guideline Mappings

Reference IDEntry IDStrengthRemarks
NIST-CSF
PR.AA-05
0
-
NIST_800_53
AC-2
0
-
NIST_800_53
AC-3
0
-
NIST_800_53
AC-5
0
-
NIST_800_53
AC-6
0
-

Assessment Requirements

IDDescriptionApplicability
CCC.IAM.CN02.AR01When an identity policy for a non-administrative principal is evaluated, it MUST NOT grant permissions for creating, updating, or attaching policies.
tlp-clear
tlp-green
tlp-amber
tlp-red
CCC.IAM.CN02.AR02When a non-administrative principal attempts to create, update, or attach policies, the service MUST deny the action.
tlp-clear
tlp-green
tlp-amber
tlp-red