An IAM role or service principal's trust policy is configured to allow principals from untrusted or overly broad scopes, such as any identity in any account, to assume or impersonate it. This can allow an external or unauthorized identity to gain access to the cloud environment, completely bypassing internal identity controls.
Overly-Permissive Identity Trust Policy
CCC.IAM.TH03
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CP06 | IAM Roles and Service Principals | The service can create, list, modify and delete roles or service principals, which are identities that applications and services use to access resources without a human user. |
| CCC.IAM.CP08 | Federated Identity - SAML | The service may be configured to trust an external identity provider using SAML 2.0, so that users authenticated by that provider can obtain cloud credentials or assume roles. |
| CCC.IAM.CP09 | Federated Identity - OIDC | The service may be configured to trust an external identity provider using OpenID Connect, so that users or workloads authenticated by that provider can obtain cloud credentials or assume roles. |
| CCC.IAM.CP12 | Policy Conditions | The service can attach conditions to a permission grant so that the grant applies only when attributes of the request, principal or resource match. |
| CCC.IAM.CP15 | Role Assumption and Delegation | The service can allow an authenticated principal to temporarily assume another role or impersonate a service identity, obtaining that identity's permissions for a limited session. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.IAM.CN03 | Restrict Role Assumption / Delegation | Limit which principals can assume a role or impersonate a service identity, and which roles a principal may pass to a resource, to only those required. This prevents unintended cross-account or public access by securing the "who can act as this identity" boundary. |
| CCC.IAM.CN11 | Enable Continuous IAM Access and Usage Analysis | Enable and configure the cloud provider's native access and usage analysis services to continuously monitor for external access paths and internal unused access. |