AC-6—Least Privilege

Moderate

High

>Control Description

Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

>FedRAMP Baseline Requirements

No FedRAMP-specific parameter values or requirements for this baseline.

>Discussion

Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege.

Organizations apply least privilege to the development, implementation, and operation of organizational systems.

>Cross-Framework Mappings

SCF

>Programmatic Queries

Beta

Related Services

IAM Access Analyzer

IAM Policy Simulator

CLI Commands

Find unused permissions with Access Analyzer

aws accessanalyzer list-findings --analyzer-arn ARN

Generate policy from CloudTrail

aws accessanalyzer start-policy-generation --policy-generation-details '{...}'

Check for admin access

aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess

List inline policies

aws iam list-user-policies --user-name USERNAME

Open AWS Console Documentation

>Relevant Technologies

Technology-specific guidance with authoritative sources and verification commands.

AWS Microsoft Entra ID Zscaler Zero Trust Exchange

>Assessment Interview Topics

Questions assessors commonly ask

Process & Governance:

•What formal policies and procedures govern the implementation of AC-6 (Least Privilege)?
•Who are the designated roles responsible for implementing, maintaining, and monitoring AC-6?
•How frequently is the AC-6 policy reviewed and updated, and what triggers policy changes?
•What training or awareness programs ensure personnel understand their responsibilities related to AC-6?

Technical Implementation:

•Describe the specific technical mechanisms or controls used to enforce AC-6 requirements.
•What automated tools, systems, or technologies are deployed to implement AC-6?
•How is AC-6 integrated into your system architecture and overall security posture?
•What configuration settings, parameters, or technical specifications enforce AC-6 requirements?

Evidence & Documentation:

•What documentation demonstrates the complete implementation of AC-6?
•What audit logs, records, reports, or monitoring data validate AC-6 compliance?
•Can you provide evidence of periodic reviews, assessments, or testing of AC-6 effectiveness?
•What artifacts would you present during a FedRAMP assessment to demonstrate AC-6 compliance?

Ask AI

Configure your API key to use AI features.