---
title: Subscription access
slug: subscription-access
docTags:
createdAt: 2026-06-24T14:51:42.115Z
---
:::ExpandableHeading{isOpen="true"}
### What is Continuous Controls Monitoring & Management subscription access group automation?
Continuous Controls Monitoring & Management subscription access group automation creates customer access groups during Continuous Controls Monitoring & Management subscription (via Continuous Controls Monitoring & Management Broker or subscription flow) and assigns predefined IAM roles to those groups.
:::
:::ExpandableHeading{isOpen="true"}
### What is the purpose of this feature?
This feature standardizes role-based access control for Continuous Controls Monitoring & Management workflows during subscription and ensures Continuous Controls Monitoring & Management personas receive appropriate permissions without manual Bridge Access Management configuration.
:::
:::ExpandableHeading{isOpen="true"}
### What happens when a customer subscribes to Continuous Controls Monitoring & Management ?
When a customer subscribes to Continuous Controls Monitoring & Management , the system automatically:
- Creates required customer access groups
- Maps each access group to the correct Continuous Controls Monitoring & Management Bridge Access Management role.
- Enables the groups for use by Workflow Service (workflowsvc)
:::
:::ExpandableHeading{isOpen="true"}
### Which personas and roles are supported?
Supported personas and roles are as follows:
| **C********CMM persona** | **IAM role** | **Access group** |
| ---------------------------------------------------------------------------------- | ----------------------------------------- | --------------------------------------------- |
| Owner | CCMMEvidenceControlOwner | Ccmm\_Evidence\_Control\_Owner |
| Approver | CCMMEvidenceApprover | Ccmm\_Evidence\_Approver |
| Reviewer | CCMMEvidenceReviewer | Ccmm\_Evidence\_Reviewer |
| Support Admin | CCMMSupportAdmin | Ccmm\_Support\_Admin |
| Administrator | CCMMAdmin | Ccmm\_Administrator |
| Viewer | CCMMViewer | Ccmm\_Viewer |
:::
:::ExpandableHeading{isOpen="true"}
### Are access groups created automatically?
Yes. Access groups are automatically created during the CCMM subscription process and mapped to the corresponding Bridge Access Management roles.
:::
:::ExpandableHeading{isOpen="true"}
### Can existing Continuous Controls Monitoring & Management subscriptions use this feature?
Existing subscriptions are not automatically updated. If new access groups are required, users must unsubscribe and resubscribe to Continuous Controls Monitoring & Management for the updated configuration to reflect.
:::
:::ExpandableHeading{isOpen="true"}
### Who is responsible for Bridge Access Management role creation?
The application team is responsible for creating IAM roles and defining associated permissions.
:::
:::ExpandableHeading{isOpen="true"}
### How are roles used in Continuous Controls Monitoring & Management workflows?
Once assigned, Bridge Access Management roles are inherited by users added to the respective access groups. The Workflow Service (workflowsvc) uses these roles to execute Continuous Controls Monitoring & Management workflows based on assigned permissions.
:::
:::ExpandableHeading{isOpen="true"}
### Does this change require any manual configuration from customers?
No manual configuration is required for new subscriptions. Access group creation and role assignments are handled automatically during the subscription process.
:::
****