aws-ct-execution-role-assumable
match (effective permission)
{
"action": "sts:AssumeRole",
"resource_type": "AWS::IAM::Role"
}
where
target role name == 'AWSControlTowerExecution'
trust policy admits the caller (mgmt-account principal) — already true by CT design
caller's identity policy grants sts:AssumeRole on arn:aws:iam::<member>:role/AWSControlTowerExecution (trust alone is insufficient)
account_of(caller) is the organization management account (SCPs cannot restrict it)
emit
| source type | Identity |
|---|---|
| source | <management-account principal> |
| target | <AWSControlTowerExecution role in member account> |
| permissions | sts:AssumeRole |
Narrative
{principal.name} (management account) can assume AWSControlTowerExecution in account {account.name} (sts:AssumeRole; role trusts the mgmt account).
Raw rule rules/explicit/aws-controltower.yaml
id: aws-ct-execution-role-assumable
emits: CanAssume
applies_to:
- aws
match_effective_permission:
action: sts:AssumeRole
resource_type: AWS::IAM::Role
where:
- target role name == 'AWSControlTowerExecution'
- "trust policy admits the caller (mgmt-account principal) \u2014 already true by CT design"
- caller's identity policy grants sts:AssumeRole on arn:aws:iam::<member>:role/AWSControlTowerExecution
(trust alone is insufficient)
- account_of(caller) is the organization management account (SCPs cannot restrict it)
emit:
source_type: Identity
source: <management-account principal>
target: <AWSControlTowerExecution role in member account>
api_source: policy evaluation (sts:AssumeRole) + iam:GetRole trust
permissions:
- sts:AssumeRole
false_positive_note: Emit only when the caller's identity policy actually grants sts:AssumeRole on the
role ARN (or a wildcard covering it) AND the caller is a management-account principal. The trust policy
admits the mgmt account, but the assume still requires the caller-side permission. Feeds derived aws-ct-execution-role-enter-account
(cross-account -> CanEnterAccount).
narrative: '{principal.name} (management account) can assume AWSControlTowerExecution in account {account.name}
(sts:AssumeRole; role trusts the mgmt account).'