Skip to main content

πŸ’Ό AC-2(1) Account Management | Automated System Account Management

  • Contextual name: πŸ’Ό AC-2(1) Account Management | Automated System Account Management
  • ID: /frameworks/nist-sp-800-53-r5/ac/02/01
  • Located in: πŸ’Ό AC-2 Account Management

Description​

Support the management of system accounts using [Assignment: organization-defined automated mechanisms].

Similar​

  • Sections
    • /frameworks/aws-fsbp-v1.0.0/appsync/05
    • /frameworks/aws-fsbp-v1.0.0/ecs/01
    • /frameworks/aws-fsbp-v1.0.0/ecs/04
    • /frameworks/aws-fsbp-v1.0.0/ecs/05
    • /frameworks/aws-fsbp-v1.0.0/elasticache/06
    • /frameworks/aws-fsbp-v1.0.0/eventbridge/03
    • /frameworks/aws-fsbp-v1.0.0/iam/01
    • /frameworks/aws-fsbp-v1.0.0/iam/02
    • /frameworks/aws-fsbp-v1.0.0/iam/03
    • /frameworks/aws-fsbp-v1.0.0/iam/04
    • /frameworks/aws-fsbp-v1.0.0/iam/05
    • /frameworks/aws-fsbp-v1.0.0/iam/06
    • /frameworks/aws-fsbp-v1.0.0/iam/07
    • /frameworks/aws-fsbp-v1.0.0/iam/08
    • /frameworks/aws-fsbp-v1.0.0/iam/21
    • /frameworks/aws-fsbp-v1.0.0/kms/01
    • /frameworks/aws-fsbp-v1.0.0/kms/02
    • /frameworks/aws-fsbp-v1.0.0/neptune/07
    • /frameworks/aws-fsbp-v1.0.0/opensearch/07
    • /frameworks/aws-fsbp-v1.0.0/rds/10
    • /frameworks/aws-fsbp-v1.0.0/rds/12
    • /frameworks/aws-fsbp-v1.0.0/s3/12
    • /frameworks/aws-fsbp-v1.0.0/sagemaker/03
    • /frameworks/aws-fsbp-v1.0.0/secrets-manager/01
    • /frameworks/aws-fsbp-v1.0.0/secrets-manager/02
    • /frameworks/aws-fsbp-v1.0.0/secrets-manager/03
    • /frameworks/aws-fsbp-v1.0.0/secrets-manager/04
  • Internal
    • ID: dec-c-ded31828

Similar Sections (Take Policies From)​

SectionSub SectionsInternal RulesPoliciesFlags
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [AppSync.5] AWS AppSync GraphQL APIs should not be authenticated with API keys
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [ECS.1] Amazon ECS task definitions should have secure networking modes and user definitions.
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [ECS.4] ECS containers should run as non-privileged
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [ECS.5] ECS containers should be limited to read-only access to root filesystems
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [ElastiCache.6] ElastiCache (Redis OSS) replication groups of earlier versions should have Redis OSS AUTH enabled
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [EventBridge.3] EventBridge custom event buses should have a resource-based policy attached
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [IAM.1] IAM policies should not allow full "*" administrative privileges11
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [IAM.2] IAM users should not have IAM policies attached11
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [IAM.3] IAM users' access keys should be rotated every 90 days or less11
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [IAM.4] IAM root user access key should not exist11
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [IAM.5] MFA should be enabled for all IAM users that have a console password1
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [IAM.6] Hardware MFA should be enabled for the root user1
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [IAM.7] Password policies for IAM users should have strong configurations12
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [IAM.8] Unused IAM user credentials should be removed1
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [IAM.21] IAM customer managed policies that you create should not allow wildcard actions for services
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [KMS.1] IAM customer managed policies should not allow decryption actions on all KMS keys
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [KMS.2] IAM principals should not have IAM inline policies that allow decryption actions on all KMS keys
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [Neptune.7] Neptune DB clusters should have IAM database authentication enabled
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [Opensearch.7] OpenSearch domains should have fine-grained access control enabled
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [RDS.10] IAM authentication should be configured for RDS instances
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [RDS.12] IAM authentication should be configured for RDS clusters
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [S3.12] ACLs should not be used to manage user access to S3 general purpose buckets
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [SageMaker.3] Users should not have root access to SageMaker AI notebook instances
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [SecretsManager.1] Secrets Manager secrets should have automatic rotation enabled
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [SecretsManager.2] Secrets Manager secrets configured with automatic rotation should rotate successfully
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [SecretsManager.3] Remove unused Secrets Manager secrets
πŸ’Ό AWS Foundational Security Best Practices v1.0.0 β†’ πŸ’Ό [SecretsManager.4] Secrets Manager secrets should be rotated within a specified number of days

Similar Sections (Give Policies To)​

SectionSub SectionsInternal RulesPoliciesFlags
πŸ’Ό FedRAMP High Security Controls β†’ πŸ’Ό AC-2(1) Automated System Account Management (M)(H)16

Sub Sections​

SectionSub SectionsInternal RulesPoliciesFlags

Policies (16)​

PolicyLogic CountFlags
πŸ“ AWS Account IAM Password Policy minimum password length is 14 characters or less 🟒1🟒 x6
πŸ“ AWS Account IAM Password Policy Number of passwords to remember is not set to 24 🟒1🟒 x6
πŸ“ AWS Account Root User has active access keys 🟒1🟒 x6
πŸ“ AWS Account Root User Hardware MFA is not enabled. 🟒🟒 x3
πŸ“ AWS IAM Policy allows full administrative privileges 🟒1🟒 x6
πŸ“ AWS IAM User Access Keys are not rotated every 90 days or less 🟒1🟒 x6
πŸ“ AWS IAM User has inline or directly attached policies 🟒1🟠 x1, 🟒 x5
πŸ“ AWS IAM User MFA is not enabled for all users with console password 🟒1🟒 x6
πŸ“ AWS IAM User with credentials unused for 45 days or more is not disabled 🟒1🟒 x6
πŸ“ Azure App Service is not registered with Microsoft Entra ID 🟒1🟒 x6
πŸ“ Azure Non-RBAC Key Vault stores Keys without expiration date 🟒1🟒 x6
πŸ“ Azure Non-RBAC Key Vault stores Secrets without expiration date 🟒1🟒 x6
πŸ“ Azure RBAC Key Vault stores Keys without expiration date 🟒1🟒 x6
πŸ“ Azure RBAC Key Vault stores Secrets without expiration date 🟒1🟒 x6
πŸ“ Azure SQL Database Transparent Data Encryption is not enabled 🟒1🟒 x6
πŸ“ Azure SQL Server Microsoft Entra authentication is not configured 🟒1🟒 x6

Internal Rules​

RulePoliciesFlags
βœ‰οΈ dec-x-0feec7902
βœ‰οΈ dec-x-1fc681bc1
βœ‰οΈ dec-x-2fcb6d852
βœ‰οΈ dec-x-82ca41272