Free plan Signups are open now. The full audytx engine — Terraform and CloudFormation — is live. The Free plan is 100 scans a month and stays free — paid tiers arrive Nov 01, 2026 from $20/month for unlimited repositories. Try it on your own code.

Roles Anywhere trust policy lacks trust-anchor scoping (aws:SourceArn / aws:SourceAccount / sts:SourceIdentity)

AWS_ROLESANYWHERE_001 HIGH Security

What it checks

Roles Anywhere trust policy lacks trust-anchor scoping (aws:SourceArn / aws:SourceAccount / sts:SourceIdentity)

Where it applies

Terraform: aws_iam_role

CloudFormation: AWS::IAM::Role

How to fix it

  1. Add Condition.ArnEquals["aws:SourceArn"] pinned to the expected trust anchor ARN (arn:aws:rolesanywhere:<region>:<account>:trust-anchor/<id>, or reference aws_rolesanywhere_trust_anchor.<name>.arn) to the rolesanywhere.amazonaws.com trust statement.
  2. For defense-in-depth, also add certificate-attribute conditions (e.g. StringEquals on aws:PrincipalTag/x509Issuer/CN) so only certificates from the intended issuer can authenticate.

Frameworks

These mappings are advisory, not an attestation of compliance.

All rules