Agent Wranglers

INF-70Required

Name the caller in every trust you give a vendor or a service

Bind every role an outside vendor may assume to a value unique to your account at that vendor, such as the external ID on AWS. Every resource policy that lets a cloud service in names your account or resource as the source.

By Agent Wranglers. Updated .

How to do it

A vendor that serves many customers holds access to all of them. Another customer can give the vendor your role's address and get your data back through it. This is the confused deputy problem. A value that the vendor issues per customer, checked in the trust policy, stops it. On AWS this is the external ID. On Google Cloud and Azure, bind the trust to the vendor's own service account or app and to a condition naming your tenant or project. A cloud service such as log delivery also writes for many accounts. So limit its access to your bucket or key with a source condition, such as aws:SourceAccount or aws:SourceArn on AWS. Trusts for your own pipelines follow Let CI sign in with OIDC, and their permissions follow Give every role the least it needs.

Examples

Terraform example

data "aws_iam_policy_document" "vendor_trust" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::111122223333:root"]
    }
    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = [var.vendor_external_id]
    }
  }
}

Shell example

# Prints each role that trusts an AWS account without an external ID. Every line must be an account in your organization.
for role in $(aws iam list-roles --query 'Roles[].RoleName' --output text); do
  aws iam get-role --role-name "$role" --query 'Role.AssumeRolePolicyDocument.Statement[?Principal.AWS && !Condition.StringEquals."sts:ExternalId"]' --output text | sed "s/^/$role /"
done

How to check

A script reads every role trust policy and resource policy from the plan or the account. Each statement whose principal is an account outside the organization has a per-customer condition, such as an external ID on AWS. Each statement whose principal is a cloud service has a source account or source resource condition.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/infrastructure/identity-and-access/confused-deputy-conditions">Agent Wranglers infrastructure and environments playbook</a>. In code you write, add a comment next to it with the same link.