FINOS-CCC/CCC.IAM.CN Control Catalog

Objective

Prevent non-administrative principals from creating new long-lived credentials like access keys or generating temporary session tokens. This blocks a common privilege escalation and persistence vector.

Assessment requirements

1. When an identity policy for a non-administrative principal is evaluated, it MUST NOT grant permissions for creating credentials or generating temporary session tokens.

   Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

2. When a non-administrative principal attempts to create new credentials or a temporary session token, the service MUST deny the action.

   Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

Guidelines

• NIST-CSF
  • PR.AA-05
• NIST_800_53
  • AC-2
  • AC-3
  • AC-5
  • AC-6

Threats

• CCC.IAM.Threats
  • CCC.IAM.TH03 — Additional Cloud Credentials Creation

Objective

Ensure that only designated administrative accounts have the ability to create, modify, or attach policies that define permissions for other identities.

Assessment requirements

1. When an identity policy for a non-administrative principal is evaluated, it MUST NOT grant permissions for creating, updating, or attaching policies.

   Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

2. When a non-administrative principal attempts to create, update, or attach policies, the service MUST deny the action.

   Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

Guidelines

• NIST-CSF
  • PR.AA-05
• NIST_800_53
  • AC-2
  • AC-3
  • AC-5
  • AC-6

Threats

• CCC.IAM.Threats
  • CCC.IAM.TH06 — IAM Policies Modification

Objective

Limit which principals can assume a role or impersonate a service identity to only those required. This prevents unintended cross-account or public access by securing the "who can act as this identity" boundary.

Assessment requirements

1. When a policy is created or updated that grants a principal permission to assume a role or impersonate a service identity, the principal MUST NOT contain a wildcard or be public/anonymous.

   Applicability: tlp-green, tlp-amber, tlp-red

2. When an external or unauthenticated principal tries to assume a role or impersonate a service identity, the service MUST deny the action.

   Applicability: tlp-green, tlp-amber, tlp-red

Guidelines

• NIST-CSF
  • PR.AC-3
  • PR.AC-4
• NIST_800_53
  • AC-2
  • AC-3
  • AC-6

Threats

• CCC.IAM.Threats
  • CCC.IAM.TH02 — Overly-Permissive Identity Trust Policy

Objective

Limit the use of wildcard permissions in IAM policies to prevent overly broad access from being granted by default.

Assessment requirements

1. When an IAM policy is created or updated, it MUST NOT contain allow statements with wildcard permissions, unless the statement is restricted by a condition.

   Applicability: tlp-green, tlp-amber, tlp-red

Guidelines

• NIST-CSF
  • PR.AC-6
• NIST_800_53
  • AC-2
  • AC-3
  • AC-6

Threats

• CCC.IAM.Threats
  • CCC.IAM.TH01 — Valid Cloud Credentials Abuse
  • CCC.IAM.TH02 — Overly-Permissive IAM Policy

Objective

Ensure that the password policies for IAM users have strong configurations.

Assessment requirements

1. When a new cloud account is provisioned, a password policy MUST be configured for IAM users following the minimum PCI DSS v4.0.1 configurations.

   Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

Guidelines

• NIST-CSF
  • PR.AA-05
• NIST_800_53
  • IA-5
• PCI-DSS
  • 8.3.9
  • 8.6.3

Threats

• CCC.IAM.Threats
  • CCC.IAM.TH01 — Valid Cloud Credentials Abuse

Objective

Ensure that long-lived static credentials like access keys are programmatically rotated within a defined time period to limit the window of opportunity if compromised.

Assessment requirements

1. When a static credential such as an access key has existed for 90 days or more, it MUST be rotated.

   Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

Guidelines

• NIST-CSF
  • PR.AA-01
• NIST_800_53
  • AC-2

Threats

• CCC.IAM.Threats
  • CCC.IAM.TH09 — Long-Lived Static Credentials
  • CCC.IAM.TH01 — Valid Cloud Credentials Abuse

Objective

Ensure that when an identity is terminated in the central Identity Provider (IdP), ts corresponding access to cloud resources is revoked automatically.

Assessment requirements

1. When a user account is disabled or deleted in the organization's IdP, the corresponding cloud identity and its access policies MUST be disabled or deleted within 24 hours.

   Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

Guidelines

• NIST-CSF
  • PR.AA-01
• NIST_800_53
  • AC-2

Threats

• CCC.IAM.Threats
  • CCC.IAM.TH10 — Orphaned Federated Identity Retains Access
  • CCC.IAM.TH01 — Valid Cloud Credentials Abuse

Objective

Ensure that unused IAM credentals are removed to reduce exposure in the event of potential compromise.

Assessment requirements

1. When an IAM user has credentials, such as passwords or access keys, that have not been used for 90 days or more, the unused credentials MUST be removed or deactivated.

   Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

Guidelines

• NIST-CSF
  • PR.AA-01
• NIST_800_53
  • AC-2

Threats

• CCC.IAM.Threats
  • CCC.IAM.TH11 — Unused Credentials
  • CCC.IAM.TH01 — Valid Cloud Credentials Abuse

Objective

Ensure that all human users must authenticate through a central, federated Identity Provider (IdP) to access the cloud environment. This eliminates cloud-native user accounts with long-lived passwords, centralizes authentication controls, and simplifies lifecycle management.

Assessment requirements

1. When a human user accesses the cloud environment, they MUST authenticate through the organization's federated IdP via a standard protocol (e.g., SAML, OIDC).

   Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

Guidelines

• NIST-CSF
  • PR.AA-01
• NIST_800_53
  • IA-2

Threats

• CCC.IAM.Threats
  • CCC.IAM.TH01 — Valid Cloud Credentials Abuse
  • CCC.IAM.TH09 — Long-Lived Static Credentials

Objective

Ensure that logs and associated alerts are generated when anomalous API requests are made by a single identity, such as API requests commonly associated with privilege escalation tactics, originating from an external or malicious IP address or performed by a previously dormant identity, which may indicate that credentals may be compromised, as well as for password brute-force attempts and account lockouts.

Assessment requirements

1. When suspicious API requests are detected, real time alerts MUST be generated to notify security personnel.

   Applicability: tlp-red

2. When suspicious API requests are detected, the associated events MUST be logged, including the source details, time, and nature of the activity.

   Applicability: tlp-green, tlp-amber, tlp-red

Guidelines

• NIST-CSF
  • DE.CM-03
  • DE.CM-06
  • DE.CM-09
• NIST_800_53
  • SI-4
  • SI-5
  • AC-2

Threats

• CCC.IAM.Threats
  • CCC.IAM.TH01 — Valid Cloud Credentials Abuse

Objective

Enable and configure the cloud provider's native access and usage analysis services to continuously monitor for external access paths and internal unused access.

Assessment requirements

1. When a cloud account or organization is provisioned, the native automated access and usage analysis services MUST be enabled to continuously monitor for external or public access to resources, and unused access.

   Applicability: tlp-clear, tlp-green, tlp-amber, tlp-red

Guidelines

• NIST-CSF
  • ID.RA-01
  • ID.IM-01
• NIST_800_53
  • AC-2
  • CA-7
  • RA-5

Threats

• CCC.IAM.Threats
  • CCC.IAM.TH02 — Overly-Permissive Identity Trust Policy
  • CCC.IAM.TH10 — Orphaned Federated Identity Retains Access
  • CCC.IAM.TH11 — Unused Credentials