Adam Moussa
acdba9a4d4
GPT-4.1 IAM cross-review 2026-06-18: APPROVE, no BLOCKs. Applied FIXes: - trust policy: add aws:SourceAccount=328440206208 (confused-deputy guard) alongside the existing aws:SourceArn trust-anchor pin - readonly policy: remove ec2:DescribeImages (data minimization — AMIs are not an idle-spend signal) - aws:RequestedRegion NIT: deliberately SKIPPED — ce:* and s3:ListAllMyBuckets are global-endpoint services a blanket region condition could DENY; rationale recorded in aws-posture-readonly-policy.rationale.md - rationale.md + CROSS-REVIEW-PACKET.md: record APPROVE + FIXes + NIT answers (snapshots=account-owned idle signal; s3 list=names-only; no logs:* needed)
27 lines
746 B
JSON
27 lines
746 B
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Sid": "RolesAnywhereAssumeFromStepCaLeaf",
|
|
"Effect": "Allow",
|
|
"Principal": {
|
|
"Service": "rolesanywhere.amazonaws.com"
|
|
},
|
|
"Action": [
|
|
"sts:AssumeRole",
|
|
"sts:TagSession",
|
|
"sts:SetSourceIdentity"
|
|
],
|
|
"Condition": {
|
|
"StringEquals": {
|
|
"aws:PrincipalTag/x509Subject/CN": "r720-aws-posture",
|
|
"aws:PrincipalTag/x509Issuer/CN": "Sea Haven Internal CA - R720 Roles Anywhere",
|
|
"aws:SourceAccount": "328440206208"
|
|
},
|
|
"ArnEquals": {
|
|
"aws:SourceArn": "arn:aws:rolesanywhere:us-east-1:328440206208:trust-anchor/REPLACE_WITH_TRUST_ANCHOR_ID"
|
|
}
|
|
}
|
|
}
|
|
]
|
|
}
|