Check provider logo

Custom IAM policy does not allow STS role assumption on wildcard resources

iam_no_custom_policy_permissive_role_assumption

Severityhigh
Serviceiam
by Prowler
identity-access

Custom IAM policies with Allow statements that grant sts:AssumeRole (or sts:*/*) to a wildcard Resource.

Risk

Broad AssumeRole rights let principals obtain temporary credentials for many roles, enabling privilege escalation, lateral movement, and cross-account access where trusts allow. This jeopardizes confidentiality and integrity of data and the control plane.

Run this check with Prowler CLI

prowler aws --checks iam_no_custom_policy_permissive_role_assumption

Run in Prowler Cloud

Recommendation

Apply least privilege to sts:AssumeRole:

  • Scope Resource to exact role ARNs
  • Require MFA and, for third parties, ExternalId
  • Enforce permissions boundaries and SCPs to block wildcards
  • Regularly remove unused role-assumption rights and separate duties

Remediation

CLI

aws iam create-policy-version --policy-arn <example_policy_arn> --policy-document '{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"sts:AssumeRole","Resource":"arn:aws:iam::<example_account_id>:role/<example_resource_name>"}]}' --set-as-default

Native IaC
Terraform
Other
  1. Open the AWS Console and go to IAM > Policies
  2. Select the custom policy that FAILED and click Edit policy (JSON)
  3. Find any statement with Effect: Allow and Action including sts:AssumeRole (or sts:* or ) where Resource is ""
  4. Change Resource to the specific role ARN(s), e.g.: arn:aws:iam::<example_account_id>:role/<example_resource_name>
  5. Save changes to create the new default version

Source Code

Resource Type

AwsIamPolicy

References