Direct answer
An IAM role's trust policy controls who may request to assume it, while the role's permissions control what the resulting session can do. Review both boundaries and any applicable organization controls.
Inventory trust relationships
Identify the role owner, intended principals, purpose and accounts. Review trust-policy principals and conditions, including federated and service principals where used. A role with a carefully limited permission policy can still have an unnecessarily broad assumption path.
Reference: AWS IAM role trust policies.
Compare intended and effective access
For a vendor support role, document the approved vendor account, purpose and conditions. Confirm any external-ID requirement or other conditions match the integration design. Review permissions granted after assumption separately from the trust policy.
- Record cross-account principals and their business owners.
- Check unused or temporary vendor access and expiry.
- Do not include session credentials in assessment evidence.
Test with controlled principals
With authorization from each account owner, use a designated allowed test principal and a separate denied principal. Confirm the allowed case can assume the test role and the denied case cannot. Keep the test role's permissions harmless and avoid accessing customer resources.
Retest a trust change
Narrow the trust policy using a planned deployment and validate the real integration in an approved window. Repeat the test principals, check audit events and review propagation and session duration; changing a trust policy does not automatically describe every existing session's lifetime.
Assessment limits
Effective access depends on identity policies, trust policy, conditions and organization restrictions. A test in one account does not establish access for every principal or already-issued session.
Frequently asked questions
Is a trust policy the same as the role's permission policy?
No. Trust defines who can assume the role under its conditions; permissions define what the assumed session may do.
Does an external ID replace permission review?
No. It addresses a specific cross-account trust concern; the trusted principal and granted permissions still require review.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.