CrossAccountTrust
A trust/resource policy names a principal in another account (feeds CanAssume/CanEnterAccount). Produced by explicit normalization (policy artifact parsing) and by derived rules (cross-account data-resource sharing patterns like S3 bucket policy with foreign principal). Subscription targets cover Azure's account-boundary analog - a cross-subscription trust (e.g. an approved cross-subscription Private Endpoint connection, or cross-subscription VNet peering).
Account, Role, ResourcePolicy, Data, Snapshot, DataLake, Storage
── CrossAccountTrust ──▸
Account, ExternalIdentity, Subscription, AnonymousIdentity
Source types
Target types
States
ACTIVE
CONDITIONAL
POTENTIAL
BLOCKED
UNKNOWN
Derivation
| nature | both |
|---|
Rules that emit CrossAccountTrust 48
A CodeArtifact domain resource policy that names a principal in another account creates a CrossAccountTrust that, combined with that principal's identity-policy grants, enables cross-account package publishing into this domain.
awsderived
A CodeArtifact repository resource policy that names a principal in another account creates a CrossAccountTrust enabling cross-account package reads or writes to that repository.
awsderived
CreateSnapshot + ModifySnapshotAttribute(add=<external account>) lets an attacker ship a full disk image to an account they control. The rule matches on the CanWrite capability on a volume and confirms effective IAM permissions for both snapshot creation and cross-account sharing.
awsderived
A repository resource policy grants ecr:PutImage to a principal in another AWS account, creating a cross-account supply-chain push trust.
awsderived
A registry-level replication policy allows an external account's repository to replicate images into the victim's registry, enabling cross-account supply-chain poisoning via the replication mechanism.
awsderived
An EventBridge custom bus resource policy granting events:PutEvents to a principal in another account establishes cross-account publish trust; the external principal can inject events that trigger compute consumers in this account.
awsderived
The Glue Data Catalog resource policy names a principal in another AWS account, granting cross-account metadata (and optionally data) access.
awsderived
A Kinesis stream resource policy granting kinesis:PutRecord(s) to a principal in another account is cross-account publish trust, enabling that external principal to trigger the stream's Lambda consumer.
awsderived
A Kinesis stream resource policy granting read actions (GetRecords/GetShardIterator/SubscribeToShard) to a foreign account enables that account to read the stream's records, supporting data exfiltration.
awsderived
An LF admin (or GRANT OPTION holder) granting Lake Formation SELECT / INSERT / DATA_LOCATION_ACCESS to a principal ARN in a foreign AWS account creates cross- account data-lake trust: the external principal can query this account's governed data via their own analytics services.
awsderived
An MSK cluster resource-based policy granting kafka-cluster:WriteData or ReadData to a principal in another account is cross-account publish/consume trust; feeds messaging-chains rule 4 and can-control's CanEnterAccount derivation.
awsderived
Domain access policy grants es:ESHttp* to a principal in a foreign AWS account, enabling cross-account data access without a role assumption.
awsderived
redshift:AuthorizeDataShare grants a consumer AWS account real-time read access to producer cluster objects, establishing cross-account live data trust.
awsderived
redshift-serverless:PutResourcePolicy allows a principal to grant another AWS account live access to a Redshift Serverless namespace via resource policy.
awsderived
A queue resource policy granting sqs:SendMessage to a principal in another account is cross-account publish trust; fed by messaging-chains rule 4 to derive CanEnterAccount.
awsderived
A VPC peering connection whose requester and accepter VPCs belong to different AWS accounts represents cross-account network trust. The peering connection record in the accepting account's AWS account constitutes the cross-account authorization artifact, enabling principals in the peer account to reach resources in this account if SG/routing permits.
awsderived
A VPC endpoint policy (gateway or interface) granting access to principals in another AWS account enables cross-account access to the backing PaaS service via the endpoint path. The endpoint policy resource is the trust artifact (modeled as ResourcePolicy source).
awsderived
An Approved private endpoint connection from a different subscription records an authorization relationship: the resource owner (in the provider subscription) has approved a network connection from an external (consumer) subscription. This models the cross-subscription trust relationship established by the approval.
azurederived
A Connected VNet peering that crosses Azure subscriptions (emitted from explicit azure-vnet-peering-record) extends network reachability AND establishes a cross-subscription trust boundary - a critical lateral-movement fact.
azurederived
A messaging resource policy that grants publish/subscribe to a principal in another account is cross-account trust (Pub/Sub topic IAM across projects emits CrossProjectTrust); feeds can-control's CanEnter* roll-up.
derived
awsexplicit
awsexplicit
awsexplicit
awsexplicit
awsexplicit
A Direct Connect Gateway-to-TransitGateway association spanning account boundaries establishes network-layer trust (on-prem has routed path into remote account's VPCs).
awsexplicit
DocumentDB cluster snapshot is shared for restore with a specific external AWS account via rds:DescribeDBClusterSnapshotAttributes (restore attribute contains account ID).
awsexplicit
A snapshot is shared to an external AWS account via ec2:DescribeSnapshotAttribute.
awsexplicit
An EFS file system policy granting ClientMount to a principal from another AWS account creates a cross-account NFS data path.
awsexplicit
A backup's resource policy (via fsx:GetResourcePolicy) grants fsx:CopyBackup to a principal in a different AWS account, establishing a cross-account trust on the backup resource.
awsexplicit
awsexplicit
awsexplicit
awsexplicit
awsexplicit
Neptune cluster snapshot is shared for restore with a specific external AWS account via neptune:DescribeDBClusterSnapshotAttributes (restore attribute contains account ID).
awsexplicit
Neptune cluster snapshot is publicly restorable (restore attribute contains 'all') via neptune:DescribeDBClusterSnapshotAttributes, establishing a CrossAccountTrust.
awsexplicit
awsexplicit
awsexplicit
awsexplicit
awsexplicit
awsexplicit
awsexplicit
awsexplicit
awsexplicit
awsexplicit
An identity with <resource>/privateEndpointConnections/write on a PaaS resource can approve a private endpoint connection from a different subscription. Approving such a connection records a cross-subscription trust: the resource owner has explicitly authorized a network connection from another subscription's VNet, extending the reach of that remote VNet across the subscription boundary.
azureexplicit