# Every way a workforce user can authenticate into the account, counted and named in one pass — how many IAM users and federated trusts exist, which SAML and OIDC providers are registered, whether an IAM Identity Center instance is the workforce entry path — together with the state of the two credentials that belong to no person: the root user's access key and the account's X.509 signing certificate

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/identity-sources-and-root-credential-lockdown

Recipe id: `identity-sources-and-root-credential-lockdown` · cadence monthly · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-IAM-APM`
- KSI `KSI-IAM-ELP`
- control `ia-2`

## Collection

Kind: `cli`

```sh
# get-account-summary
aws iam get-account-summary --query 'SummaryMap.{Users:Users,Providers:Providers,MFADevices:MFADevices,MFADevicesInUse:MFADevicesInUse,AccountAccessKeysPresent:AccountAccessKeysPresent,AccountSigningCertificatesPresent:AccountSigningCertificatesPresent}'
# list-saml-providers
aws iam list-saml-providers --query 'SAMLProviderList[].{Arn:Arn,ValidUntil:ValidUntil,CreateDate:CreateDate}'
# list-open-id-connect-providers
aws iam list-open-id-connect-providers
# list-instances
aws sso-admin list-instances --query 'Instances[].{InstanceArn:InstanceArn,IdentityStoreId:IdentityStoreId,Status:Status}'
# iam-user-mfa-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name iam-user-mfa-enabled --compliance-types NON_COMPLIANT
# iam-root-access-key-check
aws configservice get-compliance-details-by-config-rule --config-rule-name iam-root-access-key-check --compliance-types NON_COMPLIANT
```

## Expected output

Under the projection root account-summary, a SummaryMap of integers: Users and Providers size the two populations that can authenticate, MFADevices and MFADevicesInUse size the authenticator estate, and AccountAccessKeysPresent and AccountSigningCertificatesPresent are 0/1 flags for account-level credentials. Under saml-providers and oidc-providers, one entry per registered federation trust — SAMLProviderList carries Arn, ValidUntil and CreateDate (tags are not returned; GetSAMLProvider is the call for those). Under identity-center, zero or one instance with InstanceArn, IdentityStoreId and Status (CREATE_IN_PROGRESS | CREATE_FAILED | DELETE_IN_PROGRESS | ACTIVE). From AWS Config, two EvaluationResults arrays; empty NON_COMPLIANT sets mean every IAM user has an MFA device and the root user holds no access key. Managed rule identifiers: IAM_USER_MFA_ENABLED (rule name iam-user-mfa-enabled) and IAM_ROOT_ACCESS_KEY_CHECK (rule name iam-root-access-key-check).

## Assertions

_No machine-checkable assertion is authored for this recipe._

## GovCloud

IAM, IAM Identity Center and AWS Config are all available in both GovCloud (US) Regions, and both managed rules used here are in their supported-Region lists; user, provider and instance ARNs use partition arn:aws-us-gov, and an Identity Center instance ARN takes the form arn:aws-us-gov:sso:::instance/<SSOInstanceId>. Two GovCloud facts to plan around: the Identity Center administrative console, SDK and CLI must be reached over FIPS endpoints, and multi-Region Identity Center support is not available there, so one instance is the whole answer rather than one per Region. Note also that ROOT_ACCOUNT_MFA_ENABLED — the obvious companion rule — is explicitly NOT available in AWS GovCloud (US-East) or (US-West), which is why root MFA is not asserted here from AWS Config; evidence it from the IAM credential report's <root_account> row instead.

## Notes

This enumerates the authentication paths and closes the credentials that belong to nobody. What it cannot do is the word IA-02 turns on: unique. No API reports that an IAM user is one named human rather than a login three engineers share, or that a federated subject maps one-to-one onto a person on the roster — that binding lives in the personnel record and the joiner/mover/leaver process, and a reviewer establishes it by joining this output against the account inventory (see the AC-02 account-authorization-details recipe), not by reading this output alone. Rated partial for that reason: the authentication half is decided here outright, the identification half is not.

Providers counts SAML and OIDC providers together, so the two list calls are what tell you which is which. An account with Users at 0 and one Identity Center instance is the strong shape — no standing workforce credentials at all — and an account with both is the one worth explaining. Substitute nothing here: every command runs as written.

The two AWS Config rules are periodic and evaluate global IAM resource types, so deploy them in exactly one Region; adding them in several does not add coverage and does add duplicate evaluations.

## References

- {"title":"IAM API: GetAccountSummary — the SummaryMap key set (AccountAccessKeysPresent, AccountSigningCertificatesPresent, Providers, MFADevicesInUse)","url":"https://docs.aws.amazon.com/IAM/latest/APIReference/API_GetAccountSummary.html"}
- {"title":"AWS CLI: iam list-saml-providers (SAMLProviderList — Arn, ValidUntil, CreateDate; tags are not returned)","url":"https://docs.aws.amazon.com/cli/latest/reference/iam/list-saml-providers.html"}
- {"title":"AWS CLI: sso-admin list-instances (InstanceArn, IdentityStoreId, Status)","url":"https://docs.aws.amazon.com/cli/latest/reference/sso-admin/list-instances.html"}
- {"title":"AWS Config managed rule: iam-user-mfa-enabled (IAM_USER_MFA_ENABLED)","url":"https://docs.aws.amazon.com/config/latest/developerguide/iam-user-mfa-enabled.html"}
- {"title":"AWS Config managed rule: iam-root-access-key-check (IAM_ROOT_ACCESS_KEY_CHECK — COMPLIANT when the root user access key does not exist)","url":"https://docs.aws.amazon.com/config/latest/developerguide/iam-root-access-key-check.html"}
- {"title":"AWS Config managed rule: root-account-mfa-enabled — Region list excludes AWS GovCloud (US-East) and (US-West)","url":"https://docs.aws.amazon.com/config/latest/developerguide/root-account-mfa-enabled.html"}
- {"title":"AWS IAM Identity Center in AWS GovCloud (US) — FIPS endpoints for console/SDK/CLI, arn:aws-us-gov:sso:::instance/ pattern, no multi-Region support","url":"https://docs.aws.amazon.com/govcloud-us/latest/UserGuide/govcloud-sso.html"}