Trust Policy
Identity & AccessA Trust Policy (also called a role trust relationship) is a JSON policy attached to an IAM role that specifies who can call sts:AssumeRole on it. Without a trust policy allowing a principal, that principal cannot assume the role - even if their own IAM policy grants sts:AssumeRole.
Trust policies use the same syntax as IAM policies but with a Principal element instead of being attached to a principal.
Common Principal Types
- AWS service:
"Service": "ec2.amazonaws.com"(for EC2 instance roles) - Another account:
"AWS": "arn:aws:iam::123456789012:root" - Specific role/user:
"AWS": "arn:aws:iam::123456789012:role/MyRole" - SAML provider: for federated access
- OIDC provider: for web identity federation (GitHub Actions, EKS pods)
Related Terms
An AWS identity with temporary credentials that can be assumed by users, services, or applications to perform actions without long-term access keys.
The process of obtaining temporary security credentials by calling AWS STS to take on the permissions of an IAM role.
The ability to grant permissions for identities in one AWS account to access resources in another, typically using IAM roles with trust policies.
A security vulnerability where a trusted service is tricked into acting on behalf of an unauthorized party, typically prevented in AWS using external ID conditions.
Toc Consulting: AWS Security & Cloud Architecture
Securing your AWS estate?
Our team helps engineering teams secure and architect AWS the right way: assessment in week one, a prioritized action plan in week two.