AC-03 Access Enforcementac-3
Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.
Partial1 of 2 recipes reach AC-03, and none is rated full — the output narrows the question, a human judgement closes it.
AWS IAM · AWS IAM Identity Center2 recipes · 6 calls
Collect evidence (2)
Authored AWS recipes whose output is evidence for AC-03. This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.
- partialFull snapshot of every IAM user, group, role, and attached/inline policy with their relationships, used to review that granted permissions match least-privilege intentquarterlycliiam-account-authorization-detailsIAM
The API fully enumerates entitlements (telemetry), but deciding whether a given permission set is 'least privilege' requires human judgement against a documented access baseline. Reviewers should diff this snapshot against the last approved baseline and justify deltas.
- narrativeDocumented just-in-time / break-glass privilege-elevation process backed by IAM Identity Center permission sets and account assignments, showing privileged access is role/attribute-based, time-bound, and approval-gated rather than standingquarterlycliidentity-center-jit-elevation-workflowIAM Identity Center
The API proves RBAC structure and bounded session duration, but it cannot by itself prove that each elevation was requested, approved, and time-limited just-in-time. The approval/break-glass workflow and its evidence (tickets, approvals, deprovisioning records) are a documented process; attach the runbook and sampled approval records. Do not present the permission-set listing alone as proof of JIT.
What NIST requires of AC-03
The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.
Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.
Rev5 baseline membership
Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.
KSI indicators reaching this control (3)
Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.
- IAMKSI-IAM-APMAdopting Passwordless Methods
Secure passwordless methods are used for user authentication and authorization when feasible, otherwise strong passwords with phishing-resistant MFA is used.
- IAMKSI-IAM-ELPEnsuring Least Privilege
Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need.
- IAMKSI-IAM-JITAuthorizing Just-in-Time
A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services.
Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.