AWS logo
Amazon QDetector Library

Restrict assumed IAM role access High

The IAM role doesn't permit only specific services or principals for assumption. Make sure that IAM role permits only specific services or principals for assumption.

Detector ID
cloudformation/restrict-assumed-role-cloudformation@v1.0
Category
Common Weakness Enumeration (CWE) external icon

Noncompliant example

1Resources:
2  Resource:
3    Type: AWS::IAM::Role
4    Properties:
5      AssumeRolePolicyDocument:
6        Version: '2012-10-17'
7        Statement:
8          - Effect: Allow
9            Principal:
10              # Noncompliant: IAM role allows all AWS services to assume.
11              AWS:
12                - "*"
13      Policies:
14        - PolicyName: root
15          PolicyDocument:
16            Version: '2012-10-17'
17            Statement:
18              - Effect: Allow
19                Action: [ 's3:GetBucketTagging' ]
20                Resource: '*'

Compliant example

1Resources:
2  Resource:
3    Type: AWS::IAM::Role
4    Properties:
5      AssumeRolePolicyDocument:
6        Version: '2012-10-17'
7        Statement:
8          - Effect: Allow
9            Principal:
10              # Compliant: IAM role allows only specific service to assume.
11              Service: [ lambda.amazonaws.com ]
12      Policies:
13        - PolicyName: root
14          PolicyDocument:
15            Version: '2012-10-17'
16            Statement:
17              - Effect: Allow
18                Action: [ 's3:GetBucketTagging' ]
19                Resource: '*'