IAM role allows assumption from anywhere

Severity: High
Service: IAM
Check ID: IAM_ROLE_ALLOWS_ASSUMPTION_FROM_ANYWHERE

What this check finds

The IAM role's trust policy allows any other account to assume it.

Passing looks like: IAM roles not assumable from anywhere.

How to fix it

Update the trust policy to restrict the Principal to specific trusted AWS account IDs, services, or ARNs. Add a Condition with sts:ExternalId for cross-account roles.

AWS console

IAM → Roles → select role → Trust relationships → Edit trust policy.

Compliance controls it is evidence for

A failing result counts against these controls in KloudLytics; a passing one is evidence towards them. How compliance mapping works

Compliance controls mapped to IAM role allows assumption from anywhere
Framework	Controls
PCI-DSS v4.0.1	7.2 Access to system components and data is appropriately defined and assigned
HIPAA Security Rule	164.308(a)(3) Workforce Security — Access Authorization 164.308(a)(4) Information Access Management
NIST SP 800-53 Rev5 (Moderate)	AC-3 Access Enforcement AC-6 Least Privilege
NIST Cybersecurity Framework 2.0	PR.AA-05 Access permissions and authorizations are enforced with least privilege
ISO/IEC 27001:2022 Annex A	A.5.15 Access control A.8.2 Privileged access rights

Checked on every scan

KloudLytics runs this check each time it scans a connected AWS account, through a read-only role, and lists every affected resource with its region. On Pro and Business a fix is written for the specific resource rather than the general case above. The exact access it needs

More IAM checks

All IAM checks