IAM role trust policy should restrict principal to known sources

What it checks

IAM role trust policy should restrict principal to known sources

Where it applies

Terraform: aws_iam_role

CloudFormation: AWS::IAM::Role

How to fix it

1. Restrict Principal to specific account IDs or service principals (e.g. Service = "lambda.amazonaws.com")
2. For third-party cross-account access, use an sts:ExternalId unique to each customer and supplied by the third party; it is not a secret

Frameworks

• SOC 2 CC6.1
• SOC 2 CC6.3
• HIPAA 164.312(a)(1)
• HIPAA 164.312(d)

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules