Common use of Access Management Clause in Contracts

Access Management. (a) Use multi-factor authentication to control access to root account credentials and not use root account credentials beyond initial account configuration, except in using Services for which AWS Identity and Access Management (IAM) is not available. (b) Require each user to have unique security credentials that are rotated at least quarterly. (c) Use multifactor authentication or federated credentials for all authentications and grant users and groups only the minimum privileges necessary. (d) Restrict permissions in Security Groups and Access Control Lists to only those users required for Customer’s use of the Services. (e) Restrict permitted source and destination authorizations to only those required for Customer’s use of the Services. (f) Apply resource-based policies to limit access to Services only to authorized parties.

Access Management. (a) Use multi-factor authentication to control access to root account credentials and not use root account credentials beyond initial account configuration, except in using Services for which AWS Identity and Access Management (IAM) is not available. (b) Require each user to have unique security credentials that are rotated at least quarterly. (c) Use multifactor authentication or federated credentials for all authentications and grant users and groups only the minimum privileges necessary. (d) Restrict permissions in Security Groups and Access Control Lists to only those users required for Customer’s use of the Services. (e) Restrict permitted source and destination authorizations to only those required for Customer’s use of the Services. (f) Apply resource-based policies to limit access to Services only to authorized parties.