Prevent Overly Permissive Role Assumption in Custom IAM Policies
Why this matters
IAM policies that allow sts:AssumeRole with broad permissions (e.g., wildcards in the Resource or Condition fields) enable users to assume any role across the account or organization. This can:
Lead to privilege escalation and unauthorized access
Compromise isolation between roles or environments (e.g., dev, staging, production)
Bypass intended security boundaries set by role trust policies
To maintain strong access control, role assumption permissions must be narrowly scoped and explicitly defined.
What this check does
This Auto Check scans your custom IAM policies and identifies whether any:
Include sts:AssumeRole permissions with wildcard resource values (e.g., "Resource": "*")
Lack conditions that restrict role assumption to specific scenarios
Provide broad delegation rights without justification
The check fails if such permissive patterns are found.
How to fix it
Review and update all custom IAM policies that grant role assumption rights.
From the AWS Console
Sign in to the IAM Console.
Navigate to Policies and review policies with sts:AssumeRole.
Examine whether these allow wildcard access or insufficiently scoped conditions.
Modify the policies to specify:
Target role ARNs
Conditions (e.g., via aws:PrincipalArn, aws:SourceIp, StringEquals)
Where not needed, detach and delete the policy from all associated entities.
Using AWS CLI
# List entities attached to the policy
aws iam list-entities-for-policy --policy-arn <policy_arn>
# Detach from user
aws iam detach-user-policy --user-name <user_name> --policy-arn <policy_arn>
# Detach from group
aws iam detach-group-policy --group-name <group_name> --policy-arn <policy_arn>
# Detach from role
aws iam detach-role-policy --role-name <role_name> --policy-arn <policy_arn>
Exceptions
If certain services or automation pipelines require dynamic role assumption:
Use Condition blocks to validate identity or context
Limit scope to specific trusted ARNs
Monitor role usage with CloudTrail and IAM Access Analyzer
Further Resources
IAM Policy Best Practices – AWS Docs