---
title: "Name the caller in every trust you give a · Agent Wranglers"
url: https://agentwranglers.se/playbook/infrastructure/identity-and-access/confused-deputy-conditions
id: INF-70
level: Required
risk: takeover
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1123
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Name the caller in every trust you give a vendor or a service

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: INF-70
- Level: Required
- Chapter: [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access.md)
- Rule: Bind every role an outside vendor may assume to a value unique to your account at that vendor, such as the external ID on AWS. Every resource policy that lets a cloud service in names your account or resource as the source.
- Check: A script reads every role trust policy and resource policy from the plan or the account. Each statement whose principal is an account outside the organization has a per-customer condition, such as an external ID on AWS. Each statement whose principal is a cloud service has a source account or source resource condition.
- Risk: An account or system taken over
- How: A vendor that serves many customers holds access to all of them. Another customer can give the vendor your role's address and get your data back through it. This is the confused deputy problem. A value that the vendor issues per customer, checked in the trust policy, stops it. On AWS this is the external ID. On Google Cloud and Azure, bind the trust to the vendor's own service account or app and to a condition naming your tenant or project. A cloud service such as log delivery also writes for many accounts. So limit its access to your bucket or key with a source condition, such as `aws:SourceAccount` or `aws:SourceArn` on AWS. Trusts for your own pipelines follow [Let CI sign in with OIDC](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/oidc-for-ci.md), and their permissions follow [Give every role the least it needs](https://agentwranglers.se/playbook/infrastructure/identity-and-access/least-privilege-roles.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### Terraform example

```hcl
data "aws_iam_policy_document" "vendor_trust" {
  statement {
    actions = ["sts:AssumeRole"]
    principals {
      type        = "AWS"
      identifiers = ["arn:aws:iam::111122223333:root"]
    }
    condition {
      test     = "StringEquals"
      variable = "sts:ExternalId"
      values   = [var.vendor_external_id]
    }
  }
}
```

### Shell example

```sh
# Prints each role that trusts an AWS account without an external ID. Every line must be an account in your organization.
for role in $(aws iam list-roles --query 'Roles[].RoleName' --output text); do
  aws iam get-role --role-name "$role" --query 'Role.AssumeRolePolicyDocument.Statement[?Principal.AWS && !Condition.StringEquals."sts:ExternalId"]' --output text | sed "s/^/$role /"
done
```

## Sources

- [AWS IAM, The confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html)
- [Google Cloud, Workload identity federation](https://docs.cloud.google.com/iam/docs/workload-identity-federation)

## Related rules

- INF-25 [Let CI sign in with OIDC](https://agentwranglers.se/playbook/infrastructure/configuration-and-secrets/oidc-for-ci.md) in Infrastructure and environments
- INF-18 [Give every role the least it needs](https://agentwranglers.se/playbook/infrastructure/identity-and-access/least-privilege-roles.md) in Infrastructure and environments

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/infrastructure/identity-and-access/confused-deputy-conditions">Agent Wranglers infrastructure and environments playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Block sharing outside the organization](https://agentwranglers.se/playbook/infrastructure/identity-and-access/block-external-sharing.md)
- Next: [Turn on threat detection in every account](https://agentwranglers.se/playbook/infrastructure/identity-and-access/threat-detection.md)
- [Identity and access](https://agentwranglers.se/playbook/infrastructure/identity-and-access.md)