Skip to main content

💼 AC-6 Least Privilege (M)(H)

  • Contextual name: 💼 AC-6 Least Privilege (M)(H)
  • ID: /frameworks/fedramp-moderate-security-controls/ac/06
  • Located in: 💼 Access Control

Description​

Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.

Similar​

  • Sections
    • /frameworks/fedramp-high-security-controls/ac/06
  • Internal
    • ID: dec-c-e3bc71a5

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlags
💼 FedRAMP High Security Controls → 💼 AC-6 Least Privilege (M)(H)81133

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags
💼 AC-6(1) Authorize Access to Security Functions (M)(H)4
💼 AC-6(2) Non-privileged Access for Nonsecurity Functions (M)(H)4
💼 AC-6(5) Privileged Accounts (M)(H)5
💼 AC-6(7) Review of User Privileges (M)(H)2
💼 AC-6(9) Log Use of Privileged Functions (M)(H)23
💼 AC-6(10) Prohibit Non-privileged Users from Executing Privileged Functions (M)(H)3

Policies (7)​

PolicyLogic CountFlags
📝 AWS Account Root User has active access keys 🟢1🟢 x6
📝 AWS EC2 Instance IMDSv2 is not enabled 🟢1🟢 x6
📝 AWS IAM Policy allows full administrative privileges 🟢1🟢 x6
📝 AWS IAM User has inline or directly attached policies 🟢1🟠 x1, 🟢 x5
📝 AWS IAM User with credentials unused for 45 days or more is not disabled 🟢1🟢 x6
📝 AWS RDS Snapshot is publicly accessible 🟢1🟢 x6
📝 AWS S3 Bucket is not configured to block public access 🟢1🟢 x6