IBM Cloud Docs
AC-6 - Least Privilege

AC-6 - Least Privilege

Control requirements

AC-6 - 0
The organization employs the principle of least privilege, allowing only authorized accesses for users (or processes acting on behalf of users) which are necessary to accomplish assigned tasks in accordance with organizational missions and business functions.

Additional IBM Cloud for Financial Services specifications

  • Individual users are not permitted to interact with system-to-system service accounts.

Implementation guidance

See the resources that follow to learn more about how to implement this control.

IBM Cloud for Financial Services profile

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in IBM Cloud® Security and Compliance Center.

  • Check whether permissions for service ID creation are limited and configured in IAM settings for the account owner
  • Check whether permissions for API key creation are limited and configured in IAM settings for the account owner
  • Check whether permissions for API key creation are limited and configured in IAM settings for the account owner
  • Check whether App ID Cloud Directory users aren't able to update their own accounts
  • Check whether user list visibility restrictions are configured in IAM settings for the account owner
  • Check whether IAM roles are used to create IAM policies for IBM resources
  • Check whether IAM users are attached to at least one access group
  • Check whether Cloud Object Storage public access is disabled in IAM settings (not applicable to ACLs managed using S3 APIs)

NIST supplemental guidance

Organizations employ least privilege for specific duties and information systems. The principle of least privilege is also applied to information system processes, ensuring that the processes operate at privilege levels no higher than necessary to accomplish required organizational missions/business functions. Organizations consider the creation of additional processes, roles, and information system accounts as necessary, to achieve least privilege. Organizations also apply least privilege to the development, implementation, and operation of organizational information systems.