The service can allow an authenticated principal to temporarily assume another role or impersonate a service identity, obtaining that identity's permissions for a limited session.
Role Assumption and Delegation
CCC.IAM.CP15
Related Threats
| ID | Title | Description |
|---|---|---|
| CCC.IAM.TH03 | Overly-Permissive Identity Trust Policy | An IAM role or service principal's trust policy is configured to allow principals from untrusted or overly broad scopes, such as any identity in any account, to assume or impersonate it. This can allow an external or unauthorized identity to gain access to the cloud environment, completely bypassing internal identity controls. |
| CCC.IAM.TH05 | Roles are Created Without Authorization | A principal holds permissions to create roles or service identities beyond what its function requires, or a compromised identity holds such permissions. Additional roles are then created outside the organization's provisioning process, each with its own trust policy and permissions, and remain available after the originating access ends. This compromises the integrity of the access model and the confidentiality of the resources those roles can reach. |
| CCC.IAM.TH08 | Privilege Escalation via Indirect Role Usage | An identity principal possesses specific, highly privileged permissions, such as the ability to pass roles or impersonate service accounts, that allow it to leverage the permissions of a different, more privileged role. Even without being able to directly assume the target role, the principal can attach it to a new resource they control and then use that resource to perform unauthorized actions. |
| CCC.IAM.TH12 | IAM Role is Coerced into Unauthorized Cross-Account Actions (Confused Deputy) | An external actor tricks a legitimate, authorized third-party application into making requests to the cloud environment. A role in the cloud account (the "deputy"), which trusts that third-party application, then performs unauthorized actions on behalf of the actor. |