Restrict IAM User Creation in Central Landing Zone Accounts
Specification & Description
Prevent the creation of IAM users in central landing zone accounts (Management, Log Archive, Audit, Security, Network) to enforce exclusive use of IAM Identity Center for human access and IAM roles for service access.
Technical Specifications
This control is the account-scoped enforcement complement to AWS-IAM-004, which defines the SCP and the organization-wide identity strategy. The SCP that denies iam:CreateUser, iam:CreateLoginProfile, iam:CreateAccessKey, and iam:UpdateLoginProfile is defined in AWS-IAM-004 and applied at the central accounts OU. This control adds the detective layer: scanning central accounts for any IAM user other than the documented break-glass user (AWS-IAM-008) and treating any additional user as a violation. The only permitted IAM user in any central account is the break-glass user in the Management account.
Security Rationale
IAM users carry long-lived credentials that persist until manually rotated, cannot be centrally revoked by removing an IdP group assignment, and do not benefit from Identity Center's session duration limits or centralized MFA enforcement. Central landing zone accounts are the highest-value targets in the organization - credential sprawl in these accounts is disproportionately risky compared to workload accounts.
Policy Exceptions (1)
The break-glass IAM user in the Management account (AWS-IAM-008) is the only permitted IAM user in any central account. Detection queries must explicitly exclude UserName='break-glass' from violation findings.
Operational & Implementation Notes
The SCP enforcing this control lives in AWS-IAM-004 and must be applied before this control is considered fully enforced. This control contributes only the detective and remediation layers. The user deletion script removes login profiles, access keys, and attached policies before deleting the user - skipping any of these steps will cause the delete-user call to fail with a DeleteConflict error. Run the audit against each central account separately by switching profiles or using aws sts assume-role before each invocation.