# Documented just-in-time / break-glass privilege-elevation process backed by IAM Identity Center permission sets and account assignments, showing privileged access is role/attribute-based, time-bound, and approval-gated rather than standing

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/identity-center-jit-elevation-workflow

Recipe id: `identity-center-jit-elevation-workflow` · cadence quarterly · narrative

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-IAM-JIT`
- KSI `KSI-IAM-AAM`
- control `ac-3`
- control `ac-6`
- control `ac-6.5`

## Collection

_Narrative — a documented process; no API call proves this. The commands below are context, not evidence._

```sh
# aws sso-admin list-instances --query 'Instances[0].InstanceArn' --output text
# aws sso-admin list-permission-sets --instance-arn <INSTANCE_ARN>
# aws sso-admin describe-permission-set --instance-arn <INSTANCE_ARN> --permission-set-arn <PERMISSION_SET_ARN> --query 'PermissionSet.{Name:Name,SessionDuration:SessionDuration}'
# aws sso-admin list-account-assignments --instance-arn <INSTANCE_ARN> --account-id <ACCOUNT_ID> --permission-set-arn <PERMISSION_SET_ARN>
```

## Expected output

Permission set names with bounded SessionDuration (e.g. PT1H) and current account assignments; combined with the written approval-workflow runbook and ticket/approval records for each elevation

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

IAM Identity Center is available in AWS GovCloud (US); instance and permission-set ARNs use partition arn:aws-us-gov

## Notes

The API proves RBAC structure and bounded session duration, but it cannot by itself prove that each elevation was requested, approved, and time-limited just-in-time. The approval/break-glass workflow and its evidence (tickets, approvals, deprovisioning records) are a documented process; attach the runbook and sampled approval records. Do not present the permission-set listing alone as proof of JIT.

## References

- {"title":"Manage AWS accounts with permission sets — AWS IAM Identity Center","url":"https://docs.aws.amazon.com/singlesignon/latest/userguide/permissionsetsconcept.html"}
- {"title":"Set session duration for AWS accounts — the time-bound half of a break-glass elevation","url":"https://docs.aws.amazon.com/singlesignon/latest/userguide/howtosessionduration.html"}
- {"title":"AWS CLI: sso-admin list-permission-sets","url":"https://docs.aws.amazon.com/cli/latest/reference/sso-admin/list-permission-sets.html"}
- {"title":"AWS CLI: sso-admin list-account-assignments","url":"https://docs.aws.amazon.com/cli/latest/reference/sso-admin/list-account-assignments.html"}