>myctrl.tools
Preferences
Under active development — Content is continuously updated and improved
Compare

KSI-IAM-ELP—Ensuring Least Privilege

LOW
MODERATE

Formerly KSI-IAM-05

>Control Description

Persistently ensure that identity and access management employs measures to ensure each user or device can only access the resources they need.
Defined terms:
Persistently

>NIST 800-53 Controls

ac-2.5
ac-2.6
ac-3
ac-4
ac-6
ac-12
ac-14
ac-17
ac-17.1
ac-17.2
ac-17.3
ac-20
ac-20.1
cm-2.7
cm-9
ia-2
ia-3
ia-4
ia-4.4
ia-5.2
ia-5.6
ia-11
ps-2
ps-3
ps-4
ps-5
ps-6
sc-4
sc-20
sc-21
sc-22
sc-23
sc-39
si-3

>Trust Center Components
4

Ways to express your implementation of this indicator — approaches vary by organization size, complexity, and data sensitivity.

From the field: Mature implementations express least privilege through automated enforcement — default-deny IAM policies, permission boundaries enforced by cloud IAM, and privilege escalation monitoring feeding SIEM dashboards. Least privilege becomes a measurable, continuously monitored property with enforcement metrics rather than a documented policy aspiration.

Least Privilege Implementation

Product Security Features

How least privilege is enforced across the platform — default-deny policies, permission boundaries, and automated enforcement mechanisms

Privilege Escalation Monitoring

Dashboards

Dashboard expressing privilege boundary health — escalation attempts, unauthorized access patterns, and permission drift detection

Automated: SIEM rules detect and alert on unauthorized privilege escalation attempts

Least Privilege Policy Enforcement

Product Security Features

Automated enforcement of permission boundaries — policy engines preventing over-provisioned roles from being assigned

Automated: IAM policy analysis tools verify no roles exceed documented maximum privilege levels

Permission Boundary Documentation

Documents & Reports

Permission boundaries and maximum privilege levels by role

>Programmatic Queries

Beta
Cloud

CLI Commands

List attached user policies
aws iam list-attached-user-policies --user-name <username> --output table
Simulate policy for specific actions
aws iam simulate-principal-policy --policy-source-arn arn:aws:iam::<account>:user/<username> --action-names s3:GetObject s3:PutObject --output table
Find users with AdministratorAccess
aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess --output table
AWS IAM Documentation

>20x Assessment Focus Areas

Aligned with FedRAMP 20x Phase Two assessment methodology

Completeness & Coverage:

  • •Does least privilege enforcement apply to all identity types — users, service accounts, machine identities, federated identities, and third-party integrations?
  • •Are there IAM policies with wildcard permissions (e.g., `*:*`, `s3:*`) that have not been scoped down, and how are those exceptions tracked?
  • •How do you ensure least privilege extends to data access (row-level, column-level) and not just infrastructure permissions?
  • •When new applications or services are integrated, what process validates their access is scoped to only what they need before production deployment?

Automation & Validation:

  • •What automated tools detect privilege creep — permissions granted over time that exceed current job requirements?
  • •How do you identify and flag unused permissions (e.g., IAM policies that were granted but never exercised in the past 90 days)?
  • •What happens when an access review identifies excessive privileges — is access automatically revoked, or does it require manual action, and what is the SLA?
  • •How do you test that access restrictions actually work — do you run access boundary tests or attempt to access resources beyond the permitted scope?

Inventory & Integration:

  • •What tools analyze effective permissions across your cloud environment (IAM Access Analyzer, Cloud Asset Inventory, custom scripts)?
  • •How does your access review process integrate with your HR system to correlate permissions with current job roles and responsibilities?
  • •What tools discover and flag overly permissive service account or machine identity permissions?
  • •How do you maintain a map of which resources each identity can access, and is this map generated programmatically?

Continuous Evidence & Schedules:

  • •How frequently are access reviews conducted, and what evidence demonstrates every review completed on schedule with documented outcomes?
  • •Is effective permission data available via API or dashboard showing each identity's actual access scope?
  • •How do you detect when least privilege posture degrades — for example, when new broad permissions are granted outside the review cycle?
  • •What metrics trend over time to demonstrate that privilege scope is tightening rather than expanding?

Update History

2026-02-04Removed italics and changed the ID as part of new standardization in v0.9.0-beta; no material changes.

Ask AI

Configure your API key to use AI features.