Documented just-in-time / break-glass privilege-elevation process backed by IAM Identity Center permission sets and account assignments, showing privileged access is role/attribute-based, time-bound, and approval-gated rather than standing
A documented process no API can prove on its own. The commands give context; the evidence is your runbook plus records.
narrative — no API proves thiscliquarterlyIAM Identity Center
Fetch
# aws sso-admin list-instances --query 'Instances[0].InstanceArn' --output text# aws sso-admin list-permission-sets --instance-arn <INSTANCE_ARN># aws sso-admin describe-permission-set --instance-arn <INSTANCE_ARN> --permission-set-arn <PERMISSION_SET_ARN> --query 'PermissionSet.{Name:Name,SessionDuration:SessionDuration}'# aws sso-admin list-account-assignments --instance-arn <INSTANCE_ARN> --account-id <ACCOUNT_ID> --permission-set-arn <PERMISSION_SET_ARN>Expected output
Permission set names with bounded SessionDuration (e.g. PT1H) and current account assignments; combined with the written approval-workflow runbook and ticket/approval records for each elevation
Map — what it proves
- recipe3
Key Security Indicators
NIST 800-53 controls
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:AC 16/50 →
GovCloud
IAM Identity Center is available in AWS GovCloud (US); instance and permission-set ARNs use partition arn:aws-us-gov
Notes & assertions
The API proves RBAC structure and bounded session duration, but it cannot by itself prove that each elevation was requested, approved, and time-limited just-in-time. The approval/break-glass workflow and its evidence (tickets, approvals, deprovisioning records) are a documented process; attach the runbook and sampled approval records. Do not present the permission-set listing alone as proof of JIT.
References
- Manage AWS accounts with permission sets — AWS IAM Identity Center https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html
- Set session duration for AWS accounts — the time-bound half of a break-glass elevation https://docs.aws.amazon.com/singlesignon/latest/userguide/howtosessionduration.html
- AWS CLI: sso-admin list-permission-sets https://docs.aws.amazon.com/cli/latest/reference/sso-admin/list-permission-sets.html
- AWS CLI: sso-admin list-account-assignments https://docs.aws.amazon.com/cli/latest/reference/sso-admin/list-account-assignments.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Identity and Access Management run (16)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under IAM, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialAccount-wide credential report proving MFA is active per principal and that passwords/access keys are rotated within policymonthlyiam-credential-reportIAM
- partialFull snapshot of every IAM user, group, role, and attached/inline policy with their relationships, used to review that granted permissions match least-privilege intentquarterlyiam-account-authorization-detailsIAM
- partialActive unused-access findings identifying IAM roles, access keys, console passwords, and service/action-level permissions that have not been used within the configured age, driving right-sizing and removalcontinuousiam-access-analyzer-unused-accessIAM Access Analyzer
- partialAWS Config compliance result for the managed rule proving every IAM user with a console password has MFA enabledcontinuousconfig-mfa-enabled-console-accessAWS Config · IAM
- partialAWS Config compliance result proving long-lived IAM access keys (including those used by service/non-user identities) are rotated within the maximum agecontinuousconfig-access-keys-rotatedAWS Config · IAM
- partialAWS Config compliance result proving no customer-managed IAM policy grants full administrative access (Allow Action:* on Resource:*)continuousconfig-iam-policy-no-admin-accessAWS Config · IAM
- narrativeDocumented just-in-time / break-glass privilege-elevation process backed by IAM Identity Center permission sets and account assignments, showing privileged access is role/attribute-based, time-bound, and approval-gated rather than standingyou are herequarterlyidentity-center-jit-elevation-workflowIAM Identity Center
- partialGuardDuty IAM/credential-abuse findings (detection) paired with CloudTrail records of the responsive action taken to disable or secure the affected privileged principalcontinuousguardduty-suspicious-iam-activity-responseGuardDuty · CloudTrail · IAM
- partialHow operators actually reach the environment from outside it: the managed access paths that exist, the logging and encryption configured on them, the session-by-session record of who used them, and the negative check that no instance is directly reachable insteadweeklyremote-access-authorization-and-monitoringAWS Systems Manager Session Manager · AWS Client VPN · AWS Config · Amazon EC2
- partialEvery way a workforce user can authenticate into the account, counted and named in one pass — how many IAM users and federated trusts exist, which SAML and OIDC providers are registered, whether an IAM Identity Center instance is the workforce entry path — together with the state of the two credentials that belong to no person: the root user's access key and the account's X.509 signing certificatemonthlyidentity-sources-and-root-credential-lockdownAWS IAM · AWS IAM Identity Center · AWS Config
- partialFor every Amazon Cognito directory that fronts non-organizational users: the user pool's multi-factor configuration, and every identity pool's guest-access flag together with the named external providers it will exchange a token forweeklycognito-external-user-authenticationAmazon Cognito · AWS IAM
- partialThe configured ceiling on how long any credential stays valid before its holder must present an authenticator again — MaxSessionDuration on every IAM role, SessionDuration on every IAM Identity Center permission set, and the aws:MultiFactorAuthAge conditions in policy that expire an MFA-backed session independently of the session itselfquarterlysession-lifetime-and-reauthenticationAWS IAM · AWS IAM Identity Center · AWS STS
- partialThe mechanism that ends a temporary or emergency account without anyone deciding to: the AWS Config rule that measures how long an IAM credential has gone unused, the period it is configured with, the remediation configuration proving the revocation fires automatically, and an empty non-compliant set showing nothing has outlived the periodcontinuoustemporary-account-automatic-revocationAWS Config · AWS IAM · AWS Systems Manager Automation
- partialEvery identifier the account has issued, with the date it was assigned and the AWS-generated unique id behind it; the workforce identifiers issued through IAM Identity Center and the external issuer each one came from; and the CloudTrail record of identifiers being deleted, which is the only dated evidence of a name becoming free to reusecontinuousidentifier-assignment-and-reuse-preventionAWS IAM · AWS IAM Identity Center · AWS CloudTrail
- partialThe state of every credential in the account as of a stated moment, the enabled-or-disabled status of every workforce identity in the identity store, and the CloudTrail record of the revocations themselves — the five API calls that actually revoke standing access, each with the time it happened and the administrator who did itcontinuouspersonnel-separation-access-revocationAWS IAM · AWS IAM Identity Center · AWS CloudTrail
- partialWhat a transferred individual can still reach, and what they have actually used: the reassignment events themselves from CloudTrail (group membership, attached policy, and Identity Center account-assignment changes, each with its time and the administrator who made it), the current Identity Center assignments per permission set, and IAM's service-last-accessed report for the identities involved — a per-principal view of which services the identity is permitted to reach and which of those it has never authenticated to. `iam-access-analyzer-unused-access` answers the same question estate-wide from findings; this answers it for the named principal a transfer is about.continuouspersonnel-transfer-access-reassignmentAWS IAM · AWS IAM Identity Center · AWS CloudTrail