WAF-SOV-060 – Privileged Access Controlled (Separation of Duties)

Pillar: Sovereign | Severity: Critical | Category: Identity Access | Automatable: High

Description

Privileged roles MUST be minimized, time-bound, and subject to regular access reviews. Separation of Duties MUST be enforced: no single principal should be able to create infrastructure, approve deployments, AND manage encryption keys simultaneously. Wildcard IAM permissions ('' on '') are forbidden. Administrative access MUST use JIT (Just-In-Time) provisioning where technically feasible.

Rationale

Risk	Description
Risk	Permanent or far-reaching privileged roles increase insider risk and damage if compromised.
Risk	Missing time-boxing for admin access prevents effective least-privilege reviews.

Risk

Description

Risk

Permanent or far-reaching privileged roles increase insider risk and damage if compromised.

Risk

Missing time-boxing for admin access prevents effective least-privilege reviews.

Requirements

Privileged roles MUST be minimized, time-bound, and subject to regular access reviews.
Separation of Duties MUST be enforced: no single principal should be able to create infrastructure, approve deployments, AND manage encryption keys simultaneously.
Administrative access MUST use JIT (Just-In-Time) provisioning where technically feasible.

Implementation Guidance

Document the requirement in a version-controlled policy or standard.
Assign ownership and establish a review cadence (e.g., quarterly).

Maturity Levels

Level	Name	Criteria
L1	Ad hoc – control not consistently applied	* Manual evidence exists for some workloads, but coverage is unknown.
L2	Standardised – policy defined and communicated	* A version-controlled policy, ADR, or standard describes the requirement.
L3	Integrated – automated validation in CI/CD	* Terraform checks run automatically on pull requests and report results.
L4	Auditable – metrics and exceptions tracked	* Control coverage, failures, and approved exceptions are reported quarterly.
L5	Optimised – continuous improvement based on data	* Control effectiveness is measured and iteratively improved.

Level

Name

Criteria

Ad hoc – control not consistently applied

* Manual evidence exists for some workloads, but coverage is unknown.

Standardised – policy defined and communicated

* A version-controlled policy, ADR, or standard describes the requirement.

Integrated – automated validation in CI/CD

* Terraform checks run automatically on pull requests and report results.

Auditable – metrics and exceptions tracked

* Control coverage, failures, and approved exceptions are reported quarterly.

Optimised – continuous improvement based on data

* Control effectiveness is measured and iteratively improved.

Checks

waf-sov-060.tf.aws.no-wildcard-iam-policy

Engine: terraform | Provider: aws | Automated: Yes

IAM policies must not grant Action: with Resource:**

Custom IAM policies must not combine wildcard actions ('') with wildcard resources ('') as this grants full administrative access. This is the most common over-privileged pattern in AWS environments.

Scope: resource — aws_iam_policy, aws_iam_role_policy, aws_iam_user_policy

Assertions: * policy json not contains pattern pattern "Action":\\s*\\["\\]]."Resource":\\s*\\["\\]] — IAM policy grants Action: with Resource:* (full admin). This is forbidden.

Remediation: Replace wildcard Action/Resource combinations with specific permissions and specific resource ARNs following the least-privilege principle.

Compliant

data "aws_iam_policy_document" "s3_read" {
  statement {
    effect    = "Allow"
    actions   = ["s3:GetObject", "s3:ListBucket"]
    resources = [
      aws_s3_bucket.data.arn,
      "${aws_s3_bucket.data.arn}/*"
    ]
  }
}

Non-Compliant

data "aws_iam_policy_document" "admin" {
  statement {
    effect    = "Allow"
    actions   = ["*"]
    resources = ["*"]
  }
}

waf-sov-060.tf.aws.no-administrator-access-managed-policy

Engine: terraform | Provider: aws | Automated: Yes

AWS managed AdministratorAccess policy must not be attached to regular roles

The AWS managed policy 'AdministratorAccess' must not be attached to regular IAM roles or users. It is permitted only for explicitly documented break-glass emergency roles.

Scope: resource — aws_iam_role_policy_attachment, aws_iam_user_policy_attachment, aws_iam_group_policy_attachment

Assertions: * policy_arn not equals arn:aws:iam::aws:policy/AdministratorAccess — AdministratorAccess managed policy must not be attached to non-break-glass roles.

Remediation: Replace AdministratorAccess with a custom least-privilege policy. If needed for break-glass, document the use with a comment and restrict activation through JIT/approval workflow.

Compliant

resource "aws_iam_role_policy_attachment" "app" {
  role       = aws_iam_role.app.name
  policy_arn = aws_iam_policy.app_custom.arn
  # Uses a custom least-privilege policy
}

Non-Compliant

resource "aws_iam_role_policy_attachment" "admin" {
  role       = aws_iam_role.developer.name
  policy_arn = "arn:aws:iam::aws:policy/AdministratorAccess"
}

waf-sov-060.tf.aws.iam-password-policy-configured

Engine: terraform | Provider: aws | Automated: Yes

IAM account password policy must be configured

An aws_iam_account_password_policy resource must exist with minimum password length, complexity requirements, and password reuse prevention.

Scope: resource — aws_iam_account_password_policy

Assertions: * minimum_password_length greater than or equal 14 — IAM password minimum length must be >= 14 characters. * require_uppercase_characters is true — IAM password policy must require uppercase characters. * require_symbols is true — IAM password policy must require symbols. * password_reuse_prevention greater than or equal 12 — IAM password policy must prevent reuse of at least 12 previous passwords. * max_password_age less than or equal 90 — IAM password max age must be ⇐ 90 days.

Remediation: Configure an aws_iam_account_password_policy resource with strong password requirements.

Compliant

resource "aws_iam_account_password_policy" "strict" {
  minimum_password_length        = 16
  require_uppercase_characters   = true
  require_lowercase_characters   = true
  require_numbers                = true
  require_symbols                = true
  allow_users_to_change_password = true
  max_password_age               = 90
  password_reuse_prevention      = 24
}

Non-Compliant

# No aws_iam_account_password_policy resource defined

waf-sov-060.tf.aws.no-iam-user-direct-access-keys

Engine: terraform | Provider: aws | Automated: Yes

IAM users should not have long-lived access keys in Terraform

Creating aws_iam_access_key resources in Terraform creates long-lived static credentials that should be avoided. Use IAM roles, OIDC federation, or short-lived credentials instead.

Scope: resource — aws_iam_access_key

Assertions: * status not equals Active — Long-lived IAM access keys should not be created via Terraform. Use roles or OIDC.

Remediation: Replace static IAM access keys with IAM roles and temporary credentials. For CI/CD: use OIDC provider to issue short-lived tokens. For applications: use EC2 instance profiles or ECS task roles.

waf-sov-060.tf.stackit.no-wildcard-iam-policy

Engine: terraform | Provider: stackit | Automated: Yes

StackIT IAM policies must not grant wildcard permissions

StackIT IAM policies must not grant wildcard actions and resources. Follow least-privilege principles for sovereign environments.

Scope: resource — stackit_project

Assertions: * iam_policy json not contains pattern pattern "\*":\\s*"\\*" — StackIT IAM policy grants wildcard permissions.

Remediation: Replace wildcard permissions with specific actions and resource ARNs.

Compliant

# Use specific permissions for StackIT resources

Non-Compliant

# Wildcard permissions in StackIT IAM policies

waf-sov-060.config.azurerm.privileged-roles-policy

Engine: config | Provider: azurerm | Automated: Yes

Azure privileged role governance policy must be documented

A version-controlled policy document must exist at docs/sovereign/waf-sov-060-azurerm-privileged-roles.md and document the Azure implementation of privileged role minimization, time-bound access (PIM/Entra ID), and regular review.

Scope: file — docs/sovereign/waf-sov-060-azurerm-privileged-roles.md

Remediation: Create or update docs/sovereign/waf-sov-060-azurerm-privileged-roles.md. State the requirement, Azure PIM/Conditional Access configuration, review cadence, and owner.

Compliant

docs/sovereign/waf-sov-060-azurerm-privileged-roles.md:
- Azure privileged roles are limited to Owner/Contributor only via PIM with time-bound activation.
- Quarterly access reviews are scheduled.
- Break-glass accounts are excluded from PIM and documented.

Non-Compliant

# docs/sovereign/waf-sov-060-azurerm-privileged-roles.md is missing or does not contain a normative requirement.

waf-sov-060.config.google.privileged-roles-policy

Engine: config | Provider: google | Automated: Yes

GCP privileged role governance policy must be documented

A version-controlled policy document must exist at docs/sovereign/waf-sov-060-google-privileged-roles.md and document the GCP implementation of privileged role minimization, time-bound access, and regular review.

Scope: file — docs/sovereign/waf-sov-060-google-privileged-roles.md

Remediation: Create or update docs/sovereign/waf-sov-060-google-privileged-roles.md. State the requirement, GCP IAM basic-role restrictions, custom roles, review cadence, and owner.

Compliant

docs/sovereign/waf-sov-060-google-privileged-roles.md:
- GCP basic roles (owner/editor/viewer) are prohibited at project and organization level.
- Custom IAM roles are used with least privilege.
- Quarterly access reviews are scheduled.

Non-Compliant

# docs/sovereign/waf-sov-060-google-privileged-roles.md is missing or does not contain a normative requirement.

Evidence

Kind Required Description

Kind	Required	Description
`iac`	Required	Terraform configuration implementing the control.
`governance`	Required	Policy, ADR, or standard documenting the requirement.
`config`	Optional	Cloud console or API output confirming runtime state.

iac

Required

Terraform configuration implementing the control.

governance

Required

Policy, ADR, or standard documenting the requirement.

config

Optional

Cloud console or API output confirming runtime state.

Related Controls

Framework	Controls
GDPR	* Art. 32 – Security of processing (access control) * Art. 5(1)(f) – Integrity and confidentiality
BSI C5:2020	* IAM-01 – Identity and access management * IAM-03 – Privileged access management * IAM-05 – Separation of duties
BSI C3A:2026	* Dimension 5 – Operational: EU-based operational personnel * Dimension 5 – Operational: Separation of duties * Dimension 1 – Strategic: Effective control
EUCS (ENISA)	* IAM-01 – Access control policy * IAM-03 – Privileged access
ISO 27001:2022	* A.8.2 – Privileged access rights * A.8.3 – Information access restriction * A.5.3 – Segregation of duties
SOC 2 Type II	* CC6.3 – Role-based access control * CC6.6 – Logical access

Framework

Controls

GDPR

* Art. 32 – Security of processing (access control) * Art. 5(1)(f) – Integrity and confidentiality

BSI C5:2020

* IAM-01 – Identity and access management * IAM-03 – Privileged access management * IAM-05 – Separation of duties

BSI C3A:2026

* Dimension 5 – Operational: EU-based operational personnel * Dimension 5 – Operational: Separation of duties * Dimension 1 – Strategic: Effective control

EUCS (ENISA)

* IAM-01 – Access control policy * IAM-03 – Privileged access

ISO 27001:2022

* A.8.2 – Privileged access rights * A.8.3 – Information access restriction * A.5.3 – Segregation of duties

SOC 2 Type II

* CC6.3 – Role-based access control * CC6.6 – Logical access