Confused Deputy Problem
Identity & AccessThe Confused Deputy Problem occurs when a trusted entity (the "deputy") is manipulated into performing actions on behalf of an unauthorized party. In AWS, this typically happens with cross-account roles: a third-party service that assumes a role in your account could be tricked by another customer into using your role instead of theirs.
Prevention: External ID
AWS recommends using the sts:ExternalId condition in your role's trust policy. The external ID is a shared secret between you and the third party - the deputy must present it when assuming the role, preventing unauthorized parties from using the same role.
Related Terms
A resource-based policy attached to an IAM role that defines which principals (users, services, accounts) are allowed to assume that role.
The ability to grant permissions for identities in one AWS account to access resources in another, typically using IAM roles with trust policies.
The process of obtaining temporary security credentials by calling AWS STS to take on the permissions of an IAM role.
KloudSec, built by the team behind Toc Consulting
See Confused Deputy Problem checked automatically, continuously
What you just read is a manual, one-time check. KloudSec runs this and 400+ more automated checks across 90+ AWS services, continuously, agentless, live in about 5 minutes.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.