Ensure Only Approved Cross-Account IAM Role Trusts
Specification & Description
Identify and review IAM roles in central accounts that allow external AWS accounts to assume them. This control uses IAM Access Analyzer to detect cross-account access and applies preventive Service Control Policies (SCPs) to restrict trust policy modifications to approved organization boundaries.
Technical Specifications
In a Landing Zone environment, central accounts (e.g., Security, Log Archive, Shared Services) often require cross-account roles for operational tasks. However, these roles must only trust verified member accounts within the AWS Organization. This control leverages IAM Access Analyzer to provide continuous monitoring and alerting for any IAM role that allows access from outside a defined zone of trust (typically the AWS Organization). Additionally, an SCP is used to prevent the creation or update of roles with trust policies that don't include the aws:PrincipalOrgID condition, ensuring near-universal organization-level restriction.
Security Rationale
Uncontrolled cross-account trust relationships are a significant security risk, allowing potential lateral movement from compromised external accounts into the heart of the landing zone. IAM Access Analyzer provides a cost-effective, native way to identify these risks without the high overhead of AWS Config rules. Combining this with SCPs creates a "belt and suspenders" approach: SCPs prevent blatant misconfigurations, while Access Analyzer detects subtle or authorized but unrecorded external access.
Policy Exceptions (2)
Trusted third-party integrations (e.g., security tooling vendors) may require cross-account access. These must be explicitly approved and documented.
Temporary cross-account access for incident response may be allowed if time-bound and monitored.
Operational & Implementation Notes
IAM Access Analyzer is the preferred tool for cross-account visibility in landing zones due to its native integration with AWS Organizations and zero additional cost for standard findings. Unlike AWS Config, which charges per-evaluation, Access Analyzer monitors policies continuously without extra per-rule fees.