What it means
Privilege may exist through built-in administrator roles, inherited policy, break-glass accounts, automation identities, support access, or combinations of lower-level permissions.
Why it matters
Cloud control planes are highly programmable, so one privileged session can alter large environments quickly. Protection must address both standing privilege and temporary elevation.
Practical focus
- Minimize standing administrator access
- Use separate, strongly authenticated privileged identities
- Approve and time-limit elevation
- Record and review high-impact actions
Common mistakes
- Using daily user accounts for administration
- Leaving root or owner accounts as normal tools
- Protecting the console while ignoring API credentials
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: