AC-6—Least Privilege
IL4 Mod
IL4 High
IL5
IL6
>Control Description
Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
>DoD Impact Level Requirements
No specific parameter values or requirements for this impact level.
>Discussion
Organizations employ least privilege for specific duties and systems. The principle of least privilege is also applied to system processes, ensuring that the processes have access to systems and operate at privilege levels no higher than necessary to accomplish organizational missions or business functions. Organizations consider the creation of additional processes, roles, and accounts as necessary to achieve least privilege.
Organizations apply least privilege to the development, implementation, and operation of organizational systems.
>Programmatic Queries
Beta
Related Services
IAM Access Analyzer
IAM Policy Simulator
CLI Commands
Find unused permissions with Access Analyzer
aws accessanalyzer list-findings --analyzer-arn ARNGenerate policy from CloudTrail
aws accessanalyzer start-policy-generation --policy-generation-details '{...}'Check for admin access
aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccessList inline policies
aws iam list-user-policies --user-name USERNAME>Related Controls
>Assessment Interview Topics
Questions assessors commonly ask
Process & Governance:
- •What formal policies and procedures govern the implementation of AC-6 (Least Privilege)?
- •Who are the designated roles responsible for implementing, maintaining, and monitoring AC-6?
- •How frequently is the AC-6 policy reviewed and updated, and what triggers policy changes?
- •What training or awareness programs ensure personnel understand their responsibilities related to AC-6?
Technical Implementation:
- •Describe the specific technical mechanisms or controls used to enforce AC-6 requirements.
- •What automated tools, systems, or technologies are deployed to implement AC-6?
- •How is AC-6 integrated into your system architecture and overall security posture?
- •What configuration settings, parameters, or technical specifications enforce AC-6 requirements?
Evidence & Documentation:
- •What documentation demonstrates the complete implementation of AC-6?
- •What audit logs, records, reports, or monitoring data validate AC-6 compliance?
- •Can you provide evidence of periodic reviews, assessments, or testing of AC-6 effectiveness?
- •What artifacts would you present during a FedRAMP assessment to demonstrate AC-6 compliance?
Ask AI
Configure your API key to use AI features.