Homepage
About Snyk

IAM Role can be assumed by anyone in the account Affecting IAM service in AWS

Severity

high

    Is your enviroment affected by this misconfiguration?

    In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

    Test your applications
      Frameworks
      CIS-Controls CIS-AWS-Foundations CSA-CCM
    • Snyk ID SNYK-CC-TF-118
    • credit Snyk Research Team
    Report a new misconfiguration Found a mistake?

    Description

    Any principal in the account will be able to use the permissions granted by the attached policies. If a Condition is used this would be considered a medium severity.

    How to fix?

    Set Principal attribute to specific principal, e.g. arn:aws:iam::1234:role/role-name