<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# IAM Hardening Reference

Configuration guides for Azure AD/Entra ID, AWS IAM, and GCP IAM.

## Azure AD Conditional Access Essentials
1. Block legacy authentication (highest impact single policy)
2. Require MFA for all users
3. Require compliant device for sensitive apps
4. Block sign-ins from risky locations
5. Require password change on high-risk users
6. Limit session lifetime for sensitive applications

## AWS IAM Best Practices
1. Enable MFA on root account and all IAM users
2. Use IAM roles instead of long-lived access keys
3. Implement least privilege with IAM Access Analyzer
4. Enable CloudTrail for all API calls
5. Use SCPs in AWS Organizations for guardrails
6. Rotate access keys every 90 days

## Privileged Access Management
- Just-In-Time (JIT) access for admin roles
- Just-Enough-Access (JEA) with scoped permissions
- Privileged Access Workstations (PAWs)
- Session recording for privileged sessions
- Break-glass procedures for emergency access
