> For the complete documentation index, see [llms.txt](https://www.techwithtyler.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.techwithtyler.dev/cloud-security/aws/aws-offensive-security/aws-privilege-escalation/attacks-techniques-and-tools.md).

# IAM Trust Policies

## Abusing Vulnerable Trust Policies

* Poorly written IAM Trust Policies can lead to compromise

***

## AWS Service Trust Policy

### Bad policy

* This policy allows the Lambda service in **any** AWS account to assume the role. An attacker only needs to know the ARN of the role

{% code overflow="wrap" %}

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
	  "AWS": "*",
	  "Service": "lambda.amazonaws.com"
	},
      "Action": "sts:AssumeRole"
    }
  ]
}
```

{% endcode %}

### Better policy

* The role assumption is restricted to a particular lambda function within a particular AWS account but [other conditions](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html) can be specified too

{% code overflow="wrap" %}

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "lambda.amazonaws.com"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "ArnLike": {
          "aws:SourceArn": "arn:aws:lambda:<Region>:<AwsAccountId>:function:<LambdaFunction>"
        }
      }
    }
  ]
}
```

{% endcode %}

***

## Resources

{% embed url="<https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html>" %}

{% embed url="<https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_iam-condition-keys.html>" %}

{% embed url="<https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html>" %}