Lion Cipher Lab
Review every IAM role trust policy in an AWS account: who can assume what, and which trusts are too wide
- Cloud Security
- Intermediate
- ~75 min
- Free · no account required
Why it matters
An IAM role is a key to your AWS account, and its trust policy is the list of who is allowed to pick that key up. Most accounts collect dozens of roles over the years: one for every server, every function, every vendor integration, every CI pipeline and every person who signs in through the company login. Each trust was written by someone different, on a different day, under a different deadline. The dangerous ones look harmless: a vendor role with no ExternalId, a GitHub Actions role that trusts every repository on GitHub, an old contractor account nobody remembers. Attackers do not need to…
What you'll learn
- Reading an IAM role trust policy and saying, in one sentence, who can become that role
- Pulling every role and its trust policy out of a get-account-authorization-details export, including URL-encoded documents
- Spotting the seven trust mistakes that matter: open principals, unknown accounts, missing ExternalId, loose GitHub OIDC subjects, SAML without an audience check, service trusts without source keys, and whole-account trusts
- Writing a corrected trust JSON for each finding and proving the fix with a rerun
- Measuring a reviewer honestly: true positives on planted bugs, false positives on legitimate roles, and the cost of a naive rule
- Deciding when IAM Access Analyzer is enough and when a custom review earns its keep
Steps in this lab
- What a role trust policy is, in plain words
- Two halves of access, and the one same-account exception
- Get set up (from zero)
- Where the real data comes from: get-account-authorization-details
- Build a synthetic account with 44 roles and an answer key
- The seven rules, and the document each one comes from
- Write the reviewer
- Run the review and read the findings table
- Score the reviewer: true positives, false positives, and the naive baseline
- Write the fixes as corrected trust JSON
- Rerun on the fixed export: zero HIGH, zero MEDIUM
- Cross-check: IAM Access Analyzer does part of this natively
- Honest limits: what this review does not tell you
- How a pro runs this for real