Prevent IAM Roles from Assigning ReadOnlyAccess Permissions to External AWS Accounts
Why this matters
Even limited-access policies like AWS's managed ReadOnlyAccess can expose sensitive data when granted to external AWS accounts. Roles that trust third-party accounts:
Could unintentionally expose internal system configurations or security logs
May leak information about infrastructure, services in use, or account metadata
Are often overlooked in reviews due to the perception of low risk
To reduce exposure, restrict such permissions to explicitly approved partners and ensure all external sharing is audited and justified.
What this check does
This Auto Check reviews IAM roles and flags those that:
Have trust relationships with external AWS accounts (outside your organization)
Include attachment of the AWS-managed ReadOnlyAccess policy
Lack conditions or documentation justifying the relationship
The check fails if roles with external trust grant this policy without proper constraints or review.
How to fix it
Review and update all IAM roles that grant ReadOnlyAccess to external AWS accounts.
From the AWS Console
Open the IAM Console.
Navigate to Roles and inspect trust policies for external account IDs.
Check if these roles attach the arn:aws:iam::aws:policy/ReadOnlyAccess managed policy.
Take one of the following actions:
Detach the policy from the role
Modify the trust policy to remove the external account
Add conditions that scope access to specific, verified contexts (e.g., using StringEquals, SourceArn, or tags)
Delete any roles that are no longer necessary.
Using AWS CLI
# List entities using the ReadOnlyAccess policy
aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess
# Detach from role
aws iam detach-role-policy --role-name <role_name> --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess
Exceptions
In some collaboration scenarios with trusted partners (e.g., managed security services or vendors):
Use a formal access review and approval process
Restrict access to specific resources using IAM conditions
Consider creating a custom policy that limits read access to required services only
Monitor usage via CloudTrail and automate revocation if no longer used
Further Resources
IAM Best Practices – AWS Documentation
Managing IAM Role Trust Policies