Roles Here? Roles There? Roles Anywhere: Exploring the Security of AWS IAM Roles Anywhere
Summary: Unit 42 analyzed AWS IAM Roles Anywhere, an access management service introduced in 2022 that lets workloads outside AWS authenticate with X.509 digital certificates instead of long-term access keys. The article's central finding is that the service's default configuration is relatively permissive within an AWS account and region: the default role trust policy has no condition, so any certificate signed by a trust anchor in the same region can assume a role attached to a profile.
Key Takeaway: An attacker who compromises a single workload holding a valid certificate can reach other roles in the same account and region, and one with Roles Anywhere permissions can upload their own CA certificate to a trust anchor and mint valid credentials that persist until the issue is resolved.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026