Cross-account IAM assume role policy without external ID or MFA 이 페이지는 아직 한국어로 제공되지 않습니다. 번역 작업 중입니다.
현재 번역 프로젝트에 대한 질문이나 피드백이 있으신 경우
언제든지 연락주시기 바랍니다. Id: cloudformation-aws-cross-account-iam-assume-role-policy-without-external-id-or-mfa
Provider: AWS
Platform: CloudFormation
Severity: High
Category: Access Control
Learn More Description Cross-account IAM role trust policies must require either an external ID or MFA to prevent confused-deputy attacks and reduce the risk of unauthorized cross-account access.
Check AWS::IAM::Role resources’ AssumeRolePolicyDocument for Allow statements that grant sts:AssumeRole to external AWS principals. Those statements must include a Condition requiring either the sts:ExternalId condition key (for example, StringEquals) or aws:MultiFactorAuthPresent set to true. Resources missing a Condition with sts:ExternalId or aws:MultiFactorAuthPresent will be flagged.
Acceptable secure configurations include requiring an external ID or enforcing MFA in the trust policy, for example:
MyRoleWithExternalId :
Type : AWS::IAM::Role
Properties :
AssumeRolePolicyDocument :
Version : '2012-10-17'
Statement :
- Effect : Allow
Principal :
AWS : arn:aws:iam::123456789012:root
Action : sts:AssumeRole
Condition :
StringEquals :
sts:ExternalId : my-external-id
MyRoleWithMFA :
Type : AWS::IAM::Role
Properties :
AssumeRolePolicyDocument :
Version : '2012-10-17'
Statement :
- Effect : Allow
Principal :
AWS : arn:aws:iam::123456789012:root
Action : sts:AssumeRole
Condition :
Bool :
aws:MultiFactorAuthPresent : "true"
Compliant Code Examples AWSTemplateFormatVersion : "2010-09-09"
Resources :
RootRole :
Type : "AWS::IAM::Role"
Properties :
AssumeRolePolicyDocument : >
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"AWS": "arn:aws:iam::987654321145:root"
},
"Effect": "Allow",
"Resource": "*",
"Sid": "",
"Condition": {
"StringEquals": {
"sts:ExternalId": "98765"
}
}
}
]
}
AWSTemplateFormatVersion : "2010-09-09"
Resources :
RootRole :
Type : "AWS::IAM::Role"
Properties :
AssumeRolePolicyDocument : >
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"AWS": "arn:aws:iam::987654321145:root"
},
"Effect": "Allow",
"Resource": "*",
"Sid": "",
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": "true"
}
}
}
]
}
Non-Compliant Code Examples AWSTemplateFormatVersion : "2010-09-09"
Resources :
RootRole :
Type : "AWS::IAM::Role"
Properties :
AssumeRolePolicyDocument : >
{
"Version": "2012-10-17",
"Statement": [
{
"Action": "sts:AssumeRole",
"Principal": {
"AWS": "arn:aws:iam::987654321145:root"
},
"Effect": "Allow",
"Resource": "*",
"Sid": ""
}
]
}
AWSTemplateFormatVersion : "2010-09-09"
Resources :
RootRole :
Type : "AWS::IAM::Role"
Properties :
AssumeRolePolicyDocument : >
{
"Version": "2012-10-17",
"Statement": {
"Action": "sts:AssumeRole",
"Principal": {
"AWS": "arn:aws:iam::987654321145:root"
},
"Effect": "Allow",
"Resource": "*",
"Sid": "",
"Condition": {
"Bool": {
"aws:MultiFactorAuthPresent": "false"
}
}
}
}
AWSTemplateFormatVersion : "2010-09-09"
Resources :
RootRole :
Type : "AWS::IAM::Role"
Properties :
AssumeRolePolicyDocument : >
{
"Version": "2012-10-17",
"Statement": {
"Action": "sts:AssumeRole",
"Principal": {
"AWS": "arn:aws:iam::987654321145:root"
},
"Effect": "Allow",
"Resource": "*",
"Sid": "",
"Condition": {
"StringEquals": {
"sts:ExternalId": ""
}
}
}
}
