AC-06 Least Privilegeac-6
Whether an AWS call fetches evidence for this control, and what to run. Its Rev5 baselines, the indicators that reach it and the FedRAMP guidance attached to it open below.
Partial1 of 2 recipes reach AC-06, and none is rated full — the output narrows the question, a human judgement closes it.
AWS Config · AWS IAM · AWS IAM Identity Center2 recipes · 7 calls
Collect evidence (2)
Authored AWS recipes whose output is evidence for AC-06. This mapping is this project’s opinion (overlay v3.0.0), versioned separately from the dataset — the upstream FedRAMP rules name none of these tools.
- partialAWS Config compliance result proving no customer-managed IAM policy grants full administrative access (Allow Action:* on Resource:*)continuousconfig-ruleconfig-iam-policy-no-admin-accessAWS Config · IAM
Scope caveat: this rule evaluates only customer-managed policies, not inline or AWS-managed policies. Combine with iam-account-authorization-details review to cover inline policies and admin AWS-managed policy attachments (e.g. AdministratorAccess). A human closes that gap by reading iam-account-authorization-details, which is why this is partial; and nothing in the output records the explicit authorizations AC-06 (01) asks for or partitions privileged from non-privileged users as AC-06 (10) does, so neither enhancement is claimed.
- narrativeDocumented just-in-time / break-glass privilege-elevation process backed by IAM Identity Center permission sets and account assignments, showing privileged access is role/attribute-based, time-bound, and approval-gated rather than standingquarterlycliidentity-center-jit-elevation-workflowIAM Identity Center
The API proves RBAC structure and bounded session duration, but it cannot by itself prove that each elevation was requested, approved, and time-limited just-in-time. The approval/break-glass workflow and its evidence (tickets, approvals, deprovisioning records) are a documented process; attach the runbook and sampled approval records. Do not present the permission-set listing alone as proof of JIT.
What NIST requires of AC-06
The control statement from NIST 800-53 Rev5, verbatim. Square brackets are organization-defined parameters — yours to set, not FedRAMP's to dictate.
Employ the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) that are necessary to accomplish assigned organizational tasks.
NIST SP 800-53 Rev5 catalog 5.2.0, from usnistgov/oscal-content at 78650f0. The FedRAMP dataset carries no control text; this is borrowed and pinned.
Rev5 baseline membership
Membership is the whole relationship — a baseline is a set of control ids. Class A carries no baseline at all. The Low/Moderate/High labels are an interpretation from control counts, not a dataset fact.
KSI indicators reaching this control (2)
Under 20x, these indicators are how this control is demonstrated — automated KSI evidence stands in for narrative control evidence.
- IAMKSI-IAM-ELPEnsuring Least Privilege
Identity and access management measures are used and persistently reviewed to ensure each user or device can only access the resources they need.
- IAMKSI-IAM-JITAuthorizing Just-in-Time
A least-privileged, role and attribute-based, and just-in-time security authorization model is used and persistently reviewed for all user and non-user accounts and services.
Pages exist for the 209 controls reached by at least one KSI. Baseline-only controls are the orphans on /coverage. Control titles and full text live in the NIST catalog, not this dataset.