Select your cookie preferences

We use essential cookies and similar tools that are necessary to provide our site and services. We use performance cookies to collect anonymous statistics, so we can understand how customers use our site and make improvements. Essential cookies cannot be deactivated, but you can choose “Customize” or “Decline” to decline performance cookies.

If you agree, AWS and approved third parties will also use cookies to provide useful site features, remember your preferences, and display relevant content, including relevant advertising. To accept or decline all non-essential cookies, choose “Accept” or “Decline.” To make more detailed choices, choose “Customize.”

Examples to limit confused deputy problem

Focus mode
Examples to limit confused deputy problem - AWS Transfer Family

The confused deputy problem is a security issue where an entity that doesn't have permission to perform an action can coerce a more-privileged entity to perform the action. In AWS, cross-service impersonation can result in the confused deputy problem. For more details, see Cross-service confused deputy prevention.

Note

In the following examples, replace each user input placeholder with your own information.

In these examples, you can remove the ARN details for a workflow if your server doesn't have any workflows attached to it.

The following example logging/invocation policy allows any server (and workflow) in the account to assume the role.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowAllServersWithWorkflowAttached", "Effect": "Allow", "Principal": { "Service": "transfer.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "account-id" }, "ArnLike": { "aws:SourceArn": [ "arn:aws:transfer:region:account-id:server/*", "arn:aws:transfer:region:account-id:workflow/*" ] } } } ] }

The following example logging/invocation policy allows a specific server (and workflow) to assume the role.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "AllowSpecificServerWithWorkflowAttached", "Effect": "Allow", "Principal": { "Service": "transfer.amazonaws.com" }, "Action": "sts:AssumeRole", "Condition": { "StringEquals": { "aws:SourceAccount": "account-id" }, "ArnEquals": { "aws:SourceArn": [ "arn:aws:transfer:region:account-id:server/server-id", "arn:aws:transfer:region:account-id:workflow/workflow-id" ] } } } ] }
PrivacySite termsCookie preferences
© 2025, Amazon Web Services, Inc. or its affiliates. All rights reserved.