EKS IRSA role trust allows any service account (overly broad subject claim)

What it checks

EKS IRSA role trust allows any service account (overly broad subject claim)

Where it applies

Terraform: aws_iam_role

CloudFormation: AWS::IAM::Role

How to fix it

1. Replace the wildcard subject with the specific namespace and service account: "system:serviceaccount:NAMESPACE:SA_NAME". Use StringEquals (not StringLike) to prevent prefix bypasses.
2. If multiple service accounts need this role, create a separate role per service account — or use StringEquals with a specific list of subjects.

Frameworks

• SOC 2 CC6.1
• SOC 2 CC6.3

These mappings are advisory, not an attestation of compliance.

Vendor documentation

All rules