Policy Packs

guardrails-samples

This measure restricts role assumption to trusted accounts and services, reducing the risk of unauthorized access, enhancing security, and ensuring compliance with organizational policies.

Enforce AWS IAM Roles Restrict Access

main

aws_iam_role_policy_trusted_access

Take an action when AWS IAM role policy is not trusted based on the&#92;n`AWS &gt; IAM &gt; Role &gt; Policy &gt; Trusted Access &gt; *` policies.&#92;n&#92;nThe Trusted Access control evaluates the role policy against the list of allowed&#92;nmembers in each of the Trusted Access sub-policies (Trusted Access &gt; Accounts,&#92;nTrusted Access &gt; Services etc.), this control raises an alarm and takes the&#92;ndefined enforcement action.&#92;n&#92;nThe account that owns the role will always be trusted, even if its account ID is&#92;nnot included in the Trusted Accounts policy.&#92;n&#92;nIf set to `Enforce: Revoke untrusted access`, access to non-trusted&#92;nmembers will be removed.&#92;n

rolePolicyTrustedAccess

AWS > IAM > Role > Policy > Trusted Access

aws_iam_role_policy_trusted_access_accounts

List of AWS Account IDs that are trusted for cross-account access in the&#92;nAWS IAM role policy.&#92;n&#92;nNote that `Trusted Access &gt; Accounts` and `Trusted Access &gt;&#92;nOrganizations` are evaluated independently. To have access, an AWS&#92;nprincipal must be allowed in `Trusted Access &gt; Accounts` AND be a&#92;nmember of an Organization that is allowed in `Trusted Access &gt;&#92;nOrganizations`.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;123456789012&quot;&#92;n```&#92;n**Note**: Setting the policy to an `Empty` array will remove all accounts.&#92;n

rolePolicyTrustedAccounts

AWS > IAM > Role > Policy > Trusted Access > Accounts

aws_iam_role_policy_trusted_access_identity_providers

List of Identity Providers that are trusted for cross-account access in the&#92;nAWS IAM role policy.&#92;n&#92;n```&#92;nexample:&#92;n  - www.google.com&#92;n  - www.facebook.com&#92;n```&#92;n**Note**: Setting the policy to an `Empty` array will remove all identity providers.&#92;n

rolePolicyTrustedIdentityProviders

AWS > IAM > Role > Policy > Trusted Access > Identity Providers

aws_iam_role_policy_trusted_access_organizations

List of AWS Organization IDs that are trusted for cross-account access in&#92;nthe AWS IAM role policy, or &#39;*&#39; to skip the Organization Restriction.&#92;n&#92;nNote that `Trusted Access &gt; Accounts` and `Trusted Access &gt;&#92;nOrganizations` are evaluated independently. To have access, an AWS&#92;nprincipal must be allowed in `Trusted Access &gt; Accounts` AND be a&#92;nmember of an Organization that is allowed in `Trusted Access &gt;&#92;nOrganizations`.&#92;n&#92;n**Note**: `Trusted Access &gt; Organization Restrictions` are ONLY&#92;napplied to AWS principals.  Services and Federated principals do&#92;nNOT contain the `aws:PrincipalOrgId` condition key, and thus&#92;ncannot be validated against the Organization.&#92;n&#92;n```&#92;nexample:&#92;n  - &quot;o-333333333&quot;&#92;n  - &quot;o-c3a5y4wd52&quot;&#92;n```&#92;n

rolePolicyTrustedOrganizations

AWS > IAM > Role > Policy > Trusted Access > Organization Restrictions

aws_iam_role_policy_trusted_access_services

List of AWS Services that are trusted for access in the AWS IAM role policy.&#92;n&#92;n```&#92;nexample:&#92;n  - sns.amazonaws.com&#92;n  - ec2.amazonaws.com&#92;n```&#92;n&#92;n**Note**: Setting the policy to an `Empty` array will remove all services.&#92;n

Policy	Setting	Note
AWS > IAM > Role > Policy > Trusted Access	Check: Trusted Access
AWS > IAM > Role > Policy > Trusted Access > Accounts	- "123456789012" - "123456789013"
AWS > IAM > Role > Policy > Trusted Access > Identity Providers	- "www.acme.com" - "www.example.com"
AWS > IAM > Role > Policy > Trusted Access > Organization Restrictions	- "o-a3333333333" - "o-c3a5y4wd45"
AWS > IAM > Role > Policy > Trusted Access > Services	- "sns.amazonaws.com" - "ec2.amazonaws.com"

Policy Settings