AWS aws_identity_and_access_management

AWS IAM can prevent unauthorized disabling or modification of AWS security tools by enforcing least-privilege policies and explicit deny permissions for security-sensitive API operations. Protection is limited to AWS services and resources governed by IAM.

AWS IAM trust policies can restrict which CI/CD identities and OIDC subjects may assume deployment roles, while least-privilege policies restrict the AWS actions those roles can take. These controls limit unauthorized pipeline access to cloud resources.

AWS Identity and Access Management supports multi-factor authentication, which can mitigate an adversary's ability to use valid credentials obtained on one cloud to access another cloud service.

This control may mitigate the impact of compromised valid accounts by enabling fine-grained access policies and implementing least-privilege policies. MFA can provide protection against an adversary that obtains valid credentials by requiring the adversary to complete an additional authentication process before access is permitted.

The Access Analyzer tool may detect when an external entity has been granted access to cloud resources through use of access policies. This tool will scan upon any change to access policies or periodically within 24 hours.

This control may generate logs for creation and manipulation of accounts but the relevant security information would be handled by another security control.

The Access Analyzer tool may detect when an external entity has been granted access to cloud resources through use of access policies. This tool will scan upon any change to access policies or periodically within 24 hours.

The IAM MFA fields can provide data on device registration to help detect unexpected registrations.

This control may mitigate brute force attacks by enforcing multi-factor authentication, enforcing strong password policies, and rotating credentials periodically. These recommendations are IAM best practices but must be explicitly implemented by a cloud administrator.

This control may mitigate brute force attacks by enforcing multi-factor authentication, enforcing strong password policies, and rotating credentials periodically. These recommendations are IAM best practices but must be explicitly implemented by a cloud administrator.

This control may mitigate brute force attacks by enforcing multi-factor authentication, enforcing strong password policies, and rotating credentials periodically. These recommendations are IAM best practices but must be explicitly implemented by a cloud administrator.

This control may mitigate against application access token theft if the application is configured to retrieve temporary security credentials using an IAM role. This recommendation is a best practice for IAM but must be explicitly implemented by the application developer.

AWS Identity and Access Management (IAM) policy variables can limit actions based on specific variables such as ip address or username and can provide protection from unauthorized temporary elevated cloud access.

This control may mitigate against application access token theft if the application is configured to retrieve temporary security credentials using an IAM role. This recommendation is a best practice for IAM but must be explicitly implemented by the application developer.

AWS Identity and Access Management can be configured to lock at user out after repeated Multi-Factor Authentication requests.

AWS Identity and Access Management variables can be used to allow or deny malicious severless execution behavior based on variables like aws:SourceIp and aws:username.