Subscription access
Continuous Controls Monitoring & Management subscription access group automation creates customer access groups during Continuous Controls Monitoring & Management subscription (via Continuous Controls Monitoring & Management Broker or subscription flow) and assigns predefined IAM roles to those groups.
This feature standardizes role-based access control for Continuous Controls Monitoring & Management workflows during subscription and ensures Continuous Controls Monitoring & Management personas receive appropriate permissions without manual Bridge Access Management configuration.
When a customer subscribes to Continuous Controls Monitoring & Management , the system automatically:
- Creates required customer access groups
- Maps each access group to the correct Continuous Controls Monitoring & Management Bridge Access Management role.
- Enables the groups for use by Workflow Service (workflowsvc)
Supported personas and roles are as follows:
CCMM persona | IAM role | Access group |
|---|---|---|
Owner | CCMMEvidenceControlOwner | Ccmm_Evidence_Control_Owner |
Approver | CCMMEvidenceApprover | Ccmm_Evidence_Approver |
Reviewer | CCMMEvidenceReviewer | Ccmm_Evidence_Reviewer |
Support Admin | CCMMSupportAdmin | Ccmm_Support_Admin |
Administrator | CCMMAdmin | Ccmm_Administrator |
Viewer | CCMMViewer | Ccmm_Viewer |
Yes. Access groups are automatically created during the CCMM subscription process and mapped to the corresponding Bridge Access Management roles.
Existing subscriptions are not automatically updated. If new access groups are required, users must unsubscribe and resubscribe to Continuous Controls Monitoring & Management for the updated configuration to reflect.
The application team is responsible for creating IAM roles and defining associated permissions.
Once assigned, Bridge Access Management roles are inherited by users added to the respective access groups. The Workflow Service (workflowsvc) uses these roles to execute Continuous Controls Monitoring & Management workflows based on assigned permissions.
No manual configuration is required for new subscriptions. Access group creation and role assignments are handled automatically during the subscription process.