Bedrock service role trust policy lacks aws:SourceArn scoping

What it checks

Bedrock service role trust policy lacks aws:SourceArn scoping

Where it applies

Terraform: aws_iam_role

CloudFormation: AWS::IAM::Role

How to fix it

1. Add Condition.ArnLike["aws:SourceArn"] pointing to the specific agent ARN (or arn:aws:bedrock:<region>:<account>:agent/*) to the bedrock.amazonaws.com trust statement.
2. Add Condition.StringEquals["aws:SourceAccount"] = var.account_id for defense-in-depth.

Frameworks

• NIST 800-53 rev5 AC-3
• NIST 800-53 rev5 AC-6

These mappings are advisory, not an attestation of compliance.

All rules