Publicly assumable IAM role can use role chaining to access sensitive data

iam
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。

Description

A publicly assumable IAM role can use role chaining to access sensitive data. This configuration allows any AWS principal, including those from external AWS accounts, to assume the role and then assume one or more other IAM roles in sequence, following a chain of trust relationships to ultimately gain access to resources containing sensitive information such as S3 buckets, RDS databases, or DynamoDB tables. An attacker with any valid AWS credentials can exploit this misconfigured trust policy and follow the role chain to reach protected data.

Remediation

  1. Review and manage IAM roles to restrict the trust policy and limit which principals can assume the role.
  2. Apply IAM security best practices to ensure role chains follow the principle of least privilege.