Overbroad cloud role trust
A principal outside the integration's intended trust set can obtain an owned role's authority.
Candidate CWE: CWE-863
Test hypothesis#
In two owned accounts, compare the intended principal with a disallowed fixture principal against the same role and one canary metadata operation. Change only the relevant trust input or external-ID association; keep the role's data permissions constant.
Evidence required#
Caller IDs, role ARN, effective trust conditions, allowed/denied pair, resulting session identity and one canary operation with request ID.
Rule out false positives#
An intended cross-account administrator, a missing external ID without an applicable third-party deputy path, or an allow statement blocked by effective policy.
Playbook and command references#
- Cloud IAM: trust, delegation and effective permissions — Prove which principal can act on which resource, including cross-account trust, delegated roles and workload federation.
- Azure and GCP: identity, delegation and storage access — Apply provider-specific controls for Azure management/data permissions and SAS, plus GCP service accounts, federation and object ACLs.
Find the associated command snippets
Referenced by these target playbooks#
Report checklist#
- Capture the affected version, configuration, identities, and object ownership.
- Preserve a valid baseline and a negative control.
- Reproduce the forbidden data access, action, or state change on controlled fixtures.
- Explain the intended security rule and why the observed behavior violates it.
- State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.
Conditional ATT&CK mapping#
- T1078.004 · Valid Accounts: Cloud Accounts — Only if: A controlled reproduction uses compromised or misused valid cloud credentials/accounts to gain access or exceed the account's intended role; identify the specific observed goal. Not established by: The existence of a cloud account, a suspected leaked key, or authorized use of a researcher account is not enough. The official tactic list does not mean all four goals occurred.