rage.fail

TrustsExternalIdentity

Target trusts an external/federated/workload principal - inbound cross-boundary access (incl. k8s IRSA/WI federation). Source can be an identity (principal), a resource policy, or a policy document (e.g., B2C trust policy) that declares the trust.

cross_boundary AUTHORIZATION nature: explicit walkable weight 1

Role, ServiceAccount, ApplicationIdentity, ManagedIdentity, ResourcePolicy, TrustPolicy, GenericPolicy ── TrustsExternalIdentity ──▸ ExternalIdentity, FederatedIdentity, WorkloadIdentity

Source types

RoleServiceAccountApplicationIdentityManagedIdentityResourcePolicyTrustPolicyGenericPolicy

Target types

ExternalIdentityFederatedIdentityWorkloadIdentity

States

ACTIVE CONDITIONAL POTENTIAL BLOCKED UNKNOWN

Derivation

nature	explicit

Rules that emit TrustsExternalIdentity 17

gcp-ar-wif-writer-trust

An Artifact Registry repo IAM binding for a Workload Identity Federation principalSet/principal with uploadArtifacts grants an external OIDC identity (e.g. GitHub Actions) direct push access - supply-chain from external CI into GCP workloads.

gcpderived

gcp-sr-wif-writer-trust

A CSR repo IAM binding for a WIF principalSet/principal with source.repos.update grants an external OIDC identity (e.g. GitHub Actions) direct push access without any long-lived GCP key - supply-chain injection from external CI.

gcpderived

aws-cognito-role-trust-cognito-identity

awsexplicit

aws-ds-trust-record

awsexplicit

aws-eks-irsa-role-trusts-oidc-issuer

An IAM role whose trust policy Federated principal matches an EKS cluster OIDC issuer URL trusts that cluster's projected SA tokens.

awsexplicit

aws-eks-pod-identity-role-trusts-pods

An IAM role whose trust policy Service principal includes pods.eks.amazonaws.com is eligible for EKS Pod Identity associations.

awsexplicit

aws-rolesanywhere-role-trusts-external