r7.1 Enforce least privilege with IAM policies
Assign access to system components and account data based on business need, granting the minimum privilege necessary through well-defined IAM policies and roles.
AWS services
AWS IAM IAM Access Analyzer 
AWS IAM Identity Center Requirement 7
Restrict Access to System Components and Cardholder Data by Business Need to Know
PCI sub-requirements covered
- 7.2 Access to system components and data is appropriately defined and assigned
- 7.3 Access is managed via an access control system(s)
How to implement on AWS
Define IAM roles by job function with minimal permissions. Avoid long-lived IAM users in favor of roles and temporary credentials. Use IAM Access Analyzer to detect broad or external access. Remove policies with unnecessary wildcards (Action:*, Resource:*).
Practical implementation
How this control is implemented in each reference architecture:
Define IAM roles per job function with least privilege for the app/data tiers, avoid long-lived users, and run IAM Access Analyzer in the account to catch broad or external grants.
Single-account, 3-tier →Standardize least-privilege permission sets and run IAM Access Analyzer at the organization level (delegated admin) so external/broad access is detected across every CDE account from one place.
Multi-account with a dedicated PCI OU →PCI validation
Testing procedures
- Examine policies/procedures and the access-control model settings to verify access needs are defined per the requirement (7.2.1.a, 7.2.1.b).
- Examine user access settings, including privileged users, and interview management to verify assigned privileges follow classification and job function (7.2.2.b, 7.2.2.c).
- Compare assigned privileges to documented approvals by authorized personnel (7.2.3.b).
Evidence in AWS
- IAM policies and roles evidencing least privilege by function.
- IAM Access Analyzer findings with no unjustified external/broad access.
- Documented role-vs-business-function matrix.
Customized approach
Requires a targeted risk analysis (Req 12.3.2).
Customized Approach Objective
- 7.2 — Access requirements are established according to job functions following least-privilege and need-to-know principles.
- 7.3 — Access rights and privileges are managed via an access control system(s) that restricts access based on need to know and is set to deny by default.
Learning resources
References
- AWS Security Maturity Model: Least privilege