c4.5 Grant temporary elevated access
Do not grant standing access for occasional tasks like troubleshooting. Let people request temporary elevated access through an approval workflow, with the grant time-bound, audited, and approved by someone else — so a compromised identity has far less standing power.
Implementation guidance
Request access just in time
Perpetual access to everything a person might ever need is a large, standing attack surface. Instead, provision access just in time: an employee requests temporary elevated access for a specific task, ideally through an approval workflow, and the grant is time-bound, audited, and approved by a different person (separation of duties). When the window ends, the access is removed.
Implementation options
Privileged Access Management (PAM) solutions issue temporary access on demand. Vendors such as CyberArk, Okta, and others integrate with IAM Identity Center to grant temporary credentials. If you use another PAM tool, check how it integrates — prefer solutions that issue short-lived credentials and never expose or share long-lived access keys with the user. For AWS-native temporary elevation, see Temporary elevated access.
Why it matters
This is especially important for Managed Service Providers: if an admin does not routinely need privileged access to customer accounts, temporary elevated access limits the blast radius if that admin's credentials are compromised.
How to validate
- Do you provision temporary, time-bound elevated access rather than standing access for occasional tasks?
- Does an approval workflow and separation of duties govern the grant?
- If using a PAM tool, does it issue short-lived credentials (not expose or share long-lived keys) and integrate with IAM Identity Center?
Threats addressed
- A principal with perpetual access to everything it might ever need is a far more damaging target if compromised than one that must request time-bound access when needed.
- A compromised MSP admin with standing access to many customer accounts can reach all of them at once; temporary elevated access limits that exposure.
Framework mappings
AWS CAF
Well-Architected
- waf-identity-and-access-management Identity and access management
- waf-incident-response Incident response