# Overbroad cloud role trust

A principal outside the integration's intended trust set can obtain an owned role's authority.

**Candidate CWE:** [CWE-863](https://cwe.mitre.org/data/definitions/863.html)

## Test hypothesis

In two owned accounts, compare the intended principal with a disallowed fixture principal against the same role and one canary metadata operation. Change only the relevant trust input or external-ID association; keep the role's data permissions constant.

## Evidence required

Caller IDs, role ARN, effective trust conditions, allowed/denied pair, resulting session identity and one canary operation with request ID.

## Rule out false positives

An intended cross-account administrator, a missing external ID without an applicable third-party deputy path, or an allow statement blocked by effective policy.

## Playbook and command references

- [Cloud IAM: trust, delegation and effective permissions](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/cloud-iam-boundaries.html) — Prove which principal can act on which resource, including cross-account trust, delegated roles and workload federation.
- [Azure and GCP: identity, delegation and storage access](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/azure-gcp-boundaries.html) — Apply provider-specific controls for Azure management/data permissions and SAS, plus GCP service accounts, federation and object ACLs.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Cloud%20IAM%3A%20trust%2C%20delegation%20and%20effective%20permissions)

## Referenced by these target playbooks

[Cloud & containers](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/cloud.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

- [T1078.004 · Valid Accounts: Cloud Accounts](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html#T1078-004) — **Only if:** A controlled reproduction uses compromised or misused valid cloud credentials/accounts to gain access or exceed the account's intended role; identify the specific observed goal. **Not established by:** The existence of a cloud account, a suspected leaked key, or authorized use of a researcher account is not enough. The official tactic list does not mean all four goals occurred.

## Primary references

- [AWS role trust for third-party access](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html)
- [AWS policy evaluation](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_evaluation-logic.html)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)