Skip to content
FedRAMP Rules Hub
JSON — GET /api/aws-evidence

Keyboard shortcuts

Go

  • Scope — the control cataloggm
  • Plan — your last certification classgp
  • Collect — the recipe indexgc
  • The control you are workinggw
  • Startgh

Move

  • Next rowj
  • Previous rowk
  • Previous in this run[
  • Next in this run]
  • Filter this page's list/
  • Search everything⌘K

Act

  • Copy this page's permalinky
  • Toggle dark moded
  • This sheet?

Rows are whatever the current page lists — controls on Scope, recipes on Plan and Collect.

Control index

Every way a workforce user can authenticate into the account, counted and named in one pass — how many IAM users and federated trusts exist, which SAML and OIDC providers are registered, whether an IAM Identity Center instance is the workforce entry path — together with the state of the two credentials that belong to no person: the root user's access key and the account's X.509 signing certificate

JSON — GET /api/aws-evidenceMD — /collect/identity-sources-and-root-credential-lockdown.md — this page as markdown, for pasting into an agent

The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.

partial — needs judgementclimonthlyAWS IAMAWS IAM Identity CenterAWS Config

Fetch

$ aws iam get-account-summary --query 'SummaryMap.{Users:Users,Providers:Providers,MFADevices:MFADevices,MFADevicesInUse:MFADevicesInUse,AccountAccessKeysPresent:AccountAccessKeysPresent,AccountSigningCertificatesPresent:AccountSigningCertificatesPresent}'
$ aws iam list-saml-providers --query 'SAMLProviderList[].{Arn:Arn,ValidUntil:ValidUntil,CreateDate:CreateDate}'
$ aws iam list-open-id-connect-providers
$ aws sso-admin list-instances --query 'Instances[].{InstanceArn:InstanceArn,IdentityStoreId:IdentityStoreId,Status:Status}'
$ aws configservice get-compliance-details-by-config-rule --config-rule-name iam-user-mfa-enabled --compliance-types NON_COMPLIANT
$ aws configservice get-compliance-details-by-config-rule --config-rule-name iam-root-access-key-check --compliance-types NON_COMPLIANT

Expected output

Under the projection root account-summary, a SummaryMap of integers: Users and Providers size the two populations that can authenticate, MFADevices and MFADevicesInUse size the authenticator estate, and AccountAccessKeysPresent and AccountSigningCertificatesPresent are 0/1 flags for account-level credentials. Under saml-providers and oidc-providers, one entry per registered federation trust — SAMLProviderList carries Arn, ValidUntil and CreateDate (tags are not returned; GetSAMLProvider is the call for those). Under identity-center, zero or one instance with InstanceArn, IdentityStoreId and Status (CREATE_IN_PROGRESS | CREATE_FAILED | DELETE_IN_PROGRESS | ACTIVE). From AWS Config, two EvaluationResults arrays; empty NON_COMPLIANT sets mean every IAM user has an MFA device and the root user holds no access key. Managed rule identifiers: IAM_USER_MFA_ENABLED (rule name iam-user-mfa-enabled) and IAM_ROOT_ACCESS_KEY_CHECK (rule name iam-root-access-key-check).

Map — what it proves

  • recipe1
Key Security Indicators
KSI-IAM-APMKSI-IAM-ELP
NIST 800-53 controls
recipe · 3 recipesIA-02
  • recipe— an authored recipe collects evidence for this control
  • KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
  • orphan— no Key Security Indicator reaches it — a person writes it up instead

What else these families can fetch:IA 6/30 →

GovCloud

IAM, IAM Identity Center and AWS Config are all available in both GovCloud (US) Regions, and both managed rules used here are in their supported-Region lists; user, provider and instance ARNs use partition arn:aws-us-gov, and an Identity Center instance ARN takes the form arn:aws-us-gov:sso:::instance/<SSOInstanceId>. Two GovCloud facts to plan around: the Identity Center administrative console, SDK and CLI must be reached over FIPS endpoints, and multi-Region Identity Center support is not available there, so one instance is the whole answer rather than one per Region. Note also that ROOT_ACCOUNT_MFA_ENABLED — the obvious companion rule — is explicitly NOT available in AWS GovCloud (US-East) or (US-West), which is why root MFA is not asserted here from AWS Config; evidence it from the IAM credential report's <root_account> row instead.

Notes & assertions

This enumerates the authentication paths and closes the credentials that belong to nobody. What it cannot do is the word IA-02 turns on: unique. No API reports that an IAM user is one named human rather than a login three engineers share, or that a federated subject maps one-to-one onto a person on the roster — that binding lives in the personnel record and the joiner/mover/leaver process, and a reviewer establishes it by joining this output against the account inventory (see the AC-02 account-authorization-details recipe), not by reading this output alone. Rated partial for that reason: the authentication half is decided here outright, the identification half is not. Providers counts SAML and OIDC providers together, so the two list calls are what tell you which is which. An account with Users at 0 and one Identity Center instance is the strong shape — no standing workforce credentials at all — and an account with both is the one worth explaining. Substitute nothing here: every command runs as written. The two AWS Config rules are periodic and evaluate global IAM resource types, so deploy them in exactly one Region; adding them in several does not add coverage and does add duplicate evaluations.

References

This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.

The Identity and Access Management run (16)

  • automatable
  • partial — needs judgement
  • narrative — no API proves this

Every authored recipe filed under IAM, in the order the plan works them. The mark says how much of the evidence the command produces on its own.