{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/", "item": { "id": "https://update.dsesecurity.com/updates/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/", "slug": "carry-a-stable-source-identity-through-aws-role-sessions-for-investigation", "url": "https://update.dsesecurity.com/updates/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation.md", "json": "https://update.dsesecurity.com/api/v1/posts/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/" }, "title": "Carry a stable source identity through AWS role sessions for investigation", "summary": "Connect assumed-role activity to an identity attribute that survives role chaining.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "identity-cloud", "label": "Identity & cloud", "alt": "Governed cloud identity system with connected service and lifecycle nodes.", "card_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:31+00:00", "modified_at": "2026-10-20T18:34:28+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 245, "potentially_affected": "This concerns AWS role-session attribution, not proof that any arbitrary caller-supplied label identifies a real person.", "dse_recommendation": "DSE recommends selecting a stable, accountable attribute from the trusted identity workflow and documenting who can supply it.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Connect assumed-role activity to an identity attribute that survives role chaining.

\n

Source facts

\n

AWS can record a configured source identity in CloudTrail for assumed-role activity. Once set, the value cannot change during the session and persists when the role assumes another role. Setting source identity requires the relevant permissions and trust configuration; AWS does not independently control the chosen identity value.

\n

Source: AWS Documentation.

\n

Applicability

\n

This concerns AWS role-session attribution, not proof that any arbitrary caller-supplied label identifies a real person.

\n

DSE recommendation

\n

DSE recommends selecting a stable, accountable attribute from the trusted identity workflow and documenting who can supply it. Review the complete role chain for the required permission before enforcing it in production. Avoid sensitive personal data in the value. Explain how investigators should correlate it with the identity provider and account records. Assign an owner to maintain the mapping when staff identities or federation settings change, and preserve the expected format in support documentation. Define the correlation record investigators should consult when a value is unfamiliar. Review that record’s ownership and retention alongside the role chain, and make a changed identity-provider mapping a reason to repeat the attribution test before relying on it.

\n

Verification

\n

Proposed verification: assume approved test roles with the chosen source identity, follow the intended role chain and inspect the resulting CloudTrail fields. Check behavior when the attribute is missing or unauthorized. Record the evidence linking the supplied attribute to its trusted origin.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Connect assumed-role activity to an identity attribute that survives role chaining.\nSource facts\nAWS can record a configured source identity in CloudTrail for assumed-role activity. Once set, the value cannot change during the session and persists when the role assumes another role. Setting source identity requires the relevant permissions and trust configuration; AWS does not independently control the chosen identity value.\nSource: AWS Documentation.\nApplicability\nThis concerns AWS role-session attribution, not proof that any arbitrary caller-supplied label identifies a real person.\nDSE recommendation\nDSE recommends selecting a stable, accountable attribute from the trusted identity workflow and documenting who can supply it. Review the complete role chain for the required permission before enforcing it in production. Avoid sensitive personal data in the value. Explain how investigators should correlate it with the identity provider and account records. Assign an owner to maintain the mapping when staff identities or federation settings change, and preserve the expected format in support documentation. Define the correlation record investigators should consult when a value is unfamiliar. Review that record’s ownership and retention alongside the role chain, and make a changed identity-provider mapping a reason to repeat the attribution test before relying on it.\nVerification\nProposed verification: assume approved test roles with the chosen source identity, follow the intended role chain and inspect the resulting CloudTrail fields. Check behavior when the attribute is missing or unauthorized. Record the evidence linking the supplied attribute to its trusted origin.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Connect assumed-role activity to an identity attribute that survives role chaining.\n\n## Source facts\n\nAWS can record a configured source identity in CloudTrail for assumed-role activity. Once set, the value cannot change during the session and persists when the role assumes another role. Setting source identity requires the relevant permissions and trust configuration; AWS does not independently control the chosen identity value.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html).\n\n## Applicability\n\nThis concerns AWS role-session attribution, not proof that any arbitrary caller-supplied label identifies a real person.\n\n## DSE recommendation\n\nDSE recommends selecting a stable, accountable attribute from the trusted identity workflow and documenting who can supply it. Review the complete role chain for the required permission before enforcing it in production. Avoid sensitive personal data in the value. Explain how investigators should correlate it with the identity provider and account records. Assign an owner to maintain the mapping when staff identities or federation settings change, and preserve the expected format in support documentation. Define the correlation record investigators should consult when a value is unfamiliar. Review that record’s ownership and retention alongside the role chain, and make a changed identity-provider mapping a reason to repeat the attribution test before relying on it.\n\n## Verification\n\nProposed verification: assume approved test roles with the chosen source identity, follow the intended role chain and inspect the resulting CloudTrail fields. Check behavior when the attribute is missing or unauthorized. Record the evidence linking the supplied attribute to its trusted origin.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/", "url": "https://update.dsesecurity.com/updates/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Carry a stable source identity through AWS role sessions for investigation", "item": "https://update.dsesecurity.com/updates/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/#article", "identifier": "https://update.dsesecurity.com/updates/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/", "url": "https://update.dsesecurity.com/updates/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/", "headline": "Carry a stable source identity through AWS role sessions for investigation", "description": "Connect assumed-role activity to an identity attribute that survives role chaining.", "abstract": "Connect assumed-role activity to an identity attribute that survives role chaining.", "articleBody": "Connect assumed-role activity to an identity attribute that survives role chaining.\nSource facts\nAWS can record a configured source identity in CloudTrail for assumed-role activity. Once set, the value cannot change during the session and persists when the role assumes another role. Setting source identity requires the relevant permissions and trust configuration; AWS does not independently control the chosen identity value.\nSource: AWS Documentation.\nApplicability\nThis concerns AWS role-session attribution, not proof that any arbitrary caller-supplied label identifies a real person.\nDSE recommendation\nDSE recommends selecting a stable, accountable attribute from the trusted identity workflow and documenting who can supply it. Review the complete role chain for the required permission before enforcing it in production. Avoid sensitive personal data in the value. Explain how investigators should correlate it with the identity provider and account records. Assign an owner to maintain the mapping when staff identities or federation settings change, and preserve the expected format in support documentation. Define the correlation record investigators should consult when a value is unfamiliar. Review that record’s ownership and retention alongside the role chain, and make a changed identity-provider mapping a reason to repeat the attribution test before relying on it.\nVerification\nProposed verification: assume approved test roles with the chosen source identity, follow the intended role chain and inspect the resulting CloudTrail fields. Check behavior when the attribute is missing or unauthorized. Record the evidence linking the supplied attribute to its trusted origin.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:31+00:00", "dateModified": "2026-10-20T18:34:28+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/carry-a-stable-source-identity-through-aws-role-sessions-for-investigation/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/identity-cloud-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Carry a stable source identity through AWS role sessions for investigation" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 245, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_control-access_monitor.html" } } ] } }