IAM role must have a trust policy configured

Medium AWS General aws-iam-role-content-trust

Applies to

AWS::IAM::Role

What CGPulse checks

A resource passes this rule when assumeRolePolicyDocument must be set true. Anything else is reported as a finding with the evaluated property value attached as evidence.

How to fix it

Configure a properly scoped trust policy to restrict which principals can assume the role. In AWS Console: IAM > Roles > select role > Trust relationships > Edit. See: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_manage_modify.html

Terraform

resource "aws_iam_role" "{name}" {
  assume_role_policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect    = "Allow"
      Principal = { Service = "ec2.amazonaws.com" }
      Action    = "sts:AssumeRole"
    }]
  })
}

Compliance frameworks

Cloud Security: AWS Foundations

Is your environment compliant with this rule?

CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.

Run a free scan