{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/", "item": { "id": "https://update.dsesecurity.com/updates/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/", "slug": "constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service", "url": "https://update.dsesecurity.com/updates/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service.md", "json": "https://update.dsesecurity.com/api/v1/posts/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/" }, "title": "Constrain the IAM roles an operator can pass to an AWS service", "summary": "Review indirect service permissions alongside the operator's own access.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:34+00:00", "modified_at": "2026-10-20T18:34:29+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 250, "potentially_affected": "This applies to service configuration that accepts an IAM role, rather than ordinary AssumeRole access.", "dse_recommendation": "DSE recommends inventorying which deployment and support identities can assign workload roles.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Review indirect service permissions alongside the operator’s own access.

\n

Source facts

\n

iam:PassRole authorizes passing a role to a service in the same AWS account. AWS warns that a caller may indirectly exercise the passed role’s capabilities through the service. Policies can scope allowed role resources and use iam:PassedToService; AWS warns against relying on ResourceTag to control PassRole.

\n

Source: AWS Documentation.

\n

Applicability

\n

This applies to service configuration that accepts an IAM role, rather than ordinary AssumeRole access.

\n

DSE recommendation

\n

DSE recommends inventorying which deployment and support identities can assign workload roles. Limit that list to approved role ARNs and the intended services. Review the permissions of those roles before granting the caller PassRole, especially when the caller cannot directly perform the workload actions. Keep role ownership and deployment ownership in the change record. Avoid a wildcard role resource merely to clear a deployment error; identify the actual role parameter and trust configuration first. Maintain a short mapping from deployment identity to approved service role and business workload. Review new roles against that mapping before granting access, and ask the application owner to justify any capability that the deploying operator is intentionally allowed to exercise indirectly.

\n

Verification

\n

Proposed verification: use a test deployment to pass an approved role, then try a deliberately unapproved role and service combination. Confirm the workload receives only its intended permissions. Review the service configuration event and policy decision rather than expecting PassRole to appear as a standalone API operation.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Review indirect service permissions alongside the operator’s own access.\nSource facts\niam:PassRole authorizes passing a role to a service in the same AWS account. AWS warns that a caller may indirectly exercise the passed role’s capabilities through the service. Policies can scope allowed role resources and use iam:PassedToService; AWS warns against relying on ResourceTag to control PassRole.\nSource: AWS Documentation.\nApplicability\nThis applies to service configuration that accepts an IAM role, rather than ordinary AssumeRole access.\nDSE recommendation\nDSE recommends inventorying which deployment and support identities can assign workload roles. Limit that list to approved role ARNs and the intended services. Review the permissions of those roles before granting the caller PassRole, especially when the caller cannot directly perform the workload actions. Keep role ownership and deployment ownership in the change record. Avoid a wildcard role resource merely to clear a deployment error; identify the actual role parameter and trust configuration first. Maintain a short mapping from deployment identity to approved service role and business workload. Review new roles against that mapping before granting access, and ask the application owner to justify any capability that the deploying operator is intentionally allowed to exercise indirectly.\nVerification\nProposed verification: use a test deployment to pass an approved role, then try a deliberately unapproved role and service combination. Confirm the workload receives only its intended permissions. Review the service configuration event and policy decision rather than expecting PassRole to appear as a standalone API operation.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Review indirect service permissions alongside the operator’s own access.\n\n## Source facts\n\niam:PassRole authorizes passing a role to a service in the same AWS account. AWS warns that a caller may indirectly exercise the passed role’s capabilities through the service. Policies can scope allowed role resources and use iam:PassedToService; AWS warns against relying on ResourceTag to control PassRole.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html).\n\n## Applicability\n\nThis applies to service configuration that accepts an IAM role, rather than ordinary AssumeRole access.\n\n## DSE recommendation\n\nDSE recommends inventorying which deployment and support identities can assign workload roles. Limit that list to approved role ARNs and the intended services. Review the permissions of those roles before granting the caller PassRole, especially when the caller cannot directly perform the workload actions. Keep role ownership and deployment ownership in the change record. Avoid a wildcard role resource merely to clear a deployment error; identify the actual role parameter and trust configuration first. Maintain a short mapping from deployment identity to approved service role and business workload. Review new roles against that mapping before granting access, and ask the application owner to justify any capability that the deploying operator is intentionally allowed to exercise indirectly.\n\n## Verification\n\nProposed verification: use a test deployment to pass an approved role, then try a deliberately unapproved role and service combination. Confirm the workload receives only its intended permissions. Review the service configuration event and policy decision rather than expecting PassRole to appear as a standalone API operation.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/", "url": "https://update.dsesecurity.com/updates/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Constrain the IAM roles an operator can pass to an AWS service", "item": "https://update.dsesecurity.com/updates/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/#article", "identifier": "https://update.dsesecurity.com/updates/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/", "url": "https://update.dsesecurity.com/updates/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/", "headline": "Constrain the IAM roles an operator can pass to an AWS service", "description": "Review indirect service permissions alongside the operator's own access.", "abstract": "Review indirect service permissions alongside the operator's own access.", "articleBody": "Review indirect service permissions alongside the operator’s own access.\nSource facts\niam:PassRole authorizes passing a role to a service in the same AWS account. AWS warns that a caller may indirectly exercise the passed role’s capabilities through the service. Policies can scope allowed role resources and use iam:PassedToService; AWS warns against relying on ResourceTag to control PassRole.\nSource: AWS Documentation.\nApplicability\nThis applies to service configuration that accepts an IAM role, rather than ordinary AssumeRole access.\nDSE recommendation\nDSE recommends inventorying which deployment and support identities can assign workload roles. Limit that list to approved role ARNs and the intended services. Review the permissions of those roles before granting the caller PassRole, especially when the caller cannot directly perform the workload actions. Keep role ownership and deployment ownership in the change record. Avoid a wildcard role resource merely to clear a deployment error; identify the actual role parameter and trust configuration first. Maintain a short mapping from deployment identity to approved service role and business workload. Review new roles against that mapping before granting access, and ask the application owner to justify any capability that the deploying operator is intentionally allowed to exercise indirectly.\nVerification\nProposed verification: use a test deployment to pass an approved role, then try a deliberately unapproved role and service combination. Confirm the workload receives only its intended permissions. Review the service configuration event and policy decision rather than expecting PassRole to appear as a standalone API operation.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:34+00:00", "dateModified": "2026-10-20T18:34:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/constrain-the-iam-roles-an-operator-can-pass-to-an-aws-service/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Constrain the IAM roles an operator can pass to an AWS service" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 250, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html" } } ] } }