aws-rolesanywhere-role-trusts-external
match (record)
{
"field": "AssumeRolePolicyDocument",
"resource_type": "AWS::IAM::Role"
}
where
a trust-policy statement has Principal.Service == 'rolesanywhere.amazonaws.com'
Action includes sts:AssumeRole (typically also sts:TagSession + sts:SetSourceIdentity)
emit
| source type | Role |
|---|---|
| target type | FederatedIdentity |
| source | <target IAM role> |
| target | <external cert-holder identity validated by the anchor CA (FederatedIdentity)> |
Narrative
IAM role {role.name} trusts the IAM Roles Anywhere service principal; it accepts an external X.509 identity validated by trust anchor {anchor.name}, conditioned on {cert_condition_summary or 'NO certificate-attribute condition'}.
Raw rule rules/explicit/aws-rolesanywhere.yaml
id: aws-rolesanywhere-role-trusts-external
emits: TrustsExternalIdentity
applies_to:
- aws
match_record:
resource_type: AWS::IAM::Role
field: AssumeRolePolicyDocument
where:
- a trust-policy statement has Principal.Service == 'rolesanywhere.amazonaws.com'
- Action includes sts:AssumeRole (typically also sts:TagSession + sts:SetSourceIdentity)
emit:
source_type: Role
target_type: FederatedIdentity
source: <target IAM role>
target: <external cert-holder identity validated by the anchor CA (FederatedIdentity)>
api_source: iam:GetRole
evidence_field: AssumeRolePolicyDocument.Statement[].Principal.Service / Action / Condition
condition_recorded:
source_arn: aws:SourceArn (== trust-anchor ARN; absent => ANY anchor in account qualifies)
cert_subject_pin: aws:PrincipalTag/x509Subject/CN | /x509SAN/* | /x509Issuer/CN (absent => any cert
from the anchor CA matches)
trust_anchor_ca: "the CA (SigningKey \u2014 ACM PCA arn / external CA cert) the anchor validates against;\
\ forge-cert-yields-federation reads this to resolve trust_anchor_of == ?ca"
narrative: IAM role {role.name} trusts the IAM Roles Anywhere service principal; it accepts an external
X.509 identity validated by trust anchor {anchor.name}, conditioned on {cert_condition_summary or
'NO certificate-attribute condition'}.