Implement Regular Access Reviews for Landing Zone Accounts
Specification & Description
Perform manual, quarterly access reviews of IAM roles, users, and access keys across Landing Zone accounts. Use the Organization-level IAM Access Analyzer (deployed separately via AWS-IAM-010) to retrieve unused access findings as the authoritative data source for each review cycle.
Technical Specifications
This control governs the manual review process for stale or excessive permissions within Landing Zone accounts. The Organization-level IAM Access Analyzer continuously generates findings for UnusedPermission, UnusedIAMUserAccessKey, and UnusedIAMRole based on a 90-day CloudTrail-derived lookback window. On a quarterly cadence, the responsible team queries these findings per account, evaluates each identified entity, and revokes or deletes credentials and roles that are no longer operationally required. The review outcome must be documented as compliance evidence for each cycle.
Security Rationale
Unused privileged access is a persistent attack surface. Credentials or roles that exist but are never used cannot be distinguished from compromised ones during a security incident. Regular manual reviews ensure that permissions are aligned with current operational need and that accumulated drift is addressed before it can be exploited.