{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/", "item": { "id": "https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/", "slug": "require-a-vendor-assigned-external-id-for-third-party-aws-role-access", "url": "https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access.md", "json": "https://update.dsesecurity.com/api/v1/posts/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/" }, "title": "Require a vendor-assigned external ID for third-party AWS role access", "summary": "Bind a vendor role assumption to the correct customer relationship.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:30+00:00", "modified_at": "2026-10-20T18:34:28+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 239, "potentially_affected": "This applies to third-party cross-account role delegation and the confused-deputy risk, rather than password authentication.", "dse_recommendation": "DSE recommends obtaining the vendor account identity, assigned external ID and required permissions through the approved onboarding process.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Bind a vendor role assumption to the correct customer relationship.

\n

Source facts

\n

AWS recommends an external ID when a third party assumes roles for multiple customers. The vendor assigns a unique customer identifier and includes it in AssumeRole; the customer trust policy checks it. AWS does not treat the external ID as a secret. The role permission policy separately limits permitted actions.

\n

Source: AWS Documentation.

\n

Applicability

\n

This applies to third-party cross-account role delegation and the confused-deputy risk, rather than password authentication.

\n

DSE recommendation

\n

DSE recommends obtaining the vendor account identity, assigned external ID and required permissions through the approved onboarding process. Record who owns the integration and its removal procedure. Review the trust policy and permission policy separately. Do not accept a role integration that works without the required customer identifier. Keep the vendor relationship identifier accurate during account migrations, and verify that each customer uses a distinct assignment controlled by the vendor. Record the vendor’s reassignment procedure for account mergers or integration replacement. Require a named reviewer to confirm the trust-policy condition during onboarding, and make removal of the delegation a distinct offboarding step with a retained permission review.

\n

Verification

\n

Proposed verification: in an approved test integration, attempt role assumption with the correct ID, an incorrect ID and no ID. Confirm only the intended combination works, then inspect the resulting session permissions. Retain the outcomes without publishing credentials or unnecessary customer identifiers.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Bind a vendor role assumption to the correct customer relationship.\nSource facts\nAWS recommends an external ID when a third party assumes roles for multiple customers. The vendor assigns a unique customer identifier and includes it in AssumeRole; the customer trust policy checks it. AWS does not treat the external ID as a secret. The role permission policy separately limits permitted actions.\nSource: AWS Documentation.\nApplicability\nThis applies to third-party cross-account role delegation and the confused-deputy risk, rather than password authentication.\nDSE recommendation\nDSE recommends obtaining the vendor account identity, assigned external ID and required permissions through the approved onboarding process. Record who owns the integration and its removal procedure. Review the trust policy and permission policy separately. Do not accept a role integration that works without the required customer identifier. Keep the vendor relationship identifier accurate during account migrations, and verify that each customer uses a distinct assignment controlled by the vendor. Record the vendor’s reassignment procedure for account mergers or integration replacement. Require a named reviewer to confirm the trust-policy condition during onboarding, and make removal of the delegation a distinct offboarding step with a retained permission review.\nVerification\nProposed verification: in an approved test integration, attempt role assumption with the correct ID, an incorrect ID and no ID. Confirm only the intended combination works, then inspect the resulting session permissions. Retain the outcomes without publishing credentials or unnecessary customer identifiers.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Bind a vendor role assumption to the correct customer relationship.\n\n## Source facts\n\nAWS recommends an external ID when a third party assumes roles for multiple customers. The vendor assigns a unique customer identifier and includes it in AssumeRole; the customer trust policy checks it. AWS does not treat the external ID as a secret. The role permission policy separately limits permitted actions.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html).\n\n## Applicability\n\nThis applies to third-party cross-account role delegation and the confused-deputy risk, rather than password authentication.\n\n## DSE recommendation\n\nDSE recommends obtaining the vendor account identity, assigned external ID and required permissions through the approved onboarding process. Record who owns the integration and its removal procedure. Review the trust policy and permission policy separately. Do not accept a role integration that works without the required customer identifier. Keep the vendor relationship identifier accurate during account migrations, and verify that each customer uses a distinct assignment controlled by the vendor. Record the vendor’s reassignment procedure for account mergers or integration replacement. Require a named reviewer to confirm the trust-policy condition during onboarding, and make removal of the delegation a distinct offboarding step with a retained permission review.\n\n## Verification\n\nProposed verification: in an approved test integration, attempt role assumption with the correct ID, an incorrect ID and no ID. Confirm only the intended combination works, then inspect the resulting session permissions. Retain the outcomes without publishing credentials or unnecessary customer identifiers.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/", "url": "https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Require a vendor-assigned external ID for third-party AWS role access", "item": "https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/#article", "identifier": "https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/", "url": "https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/", "headline": "Require a vendor-assigned external ID for third-party AWS role access", "description": "Bind a vendor role assumption to the correct customer relationship.", "abstract": "Bind a vendor role assumption to the correct customer relationship.", "articleBody": "Bind a vendor role assumption to the correct customer relationship.\nSource facts\nAWS recommends an external ID when a third party assumes roles for multiple customers. The vendor assigns a unique customer identifier and includes it in AssumeRole; the customer trust policy checks it. AWS does not treat the external ID as a secret. The role permission policy separately limits permitted actions.\nSource: AWS Documentation.\nApplicability\nThis applies to third-party cross-account role delegation and the confused-deputy risk, rather than password authentication.\nDSE recommendation\nDSE recommends obtaining the vendor account identity, assigned external ID and required permissions through the approved onboarding process. Record who owns the integration and its removal procedure. Review the trust policy and permission policy separately. Do not accept a role integration that works without the required customer identifier. Keep the vendor relationship identifier accurate during account migrations, and verify that each customer uses a distinct assignment controlled by the vendor. Record the vendor’s reassignment procedure for account mergers or integration replacement. Require a named reviewer to confirm the trust-policy condition during onboarding, and make removal of the delegation a distinct offboarding step with a retained permission review.\nVerification\nProposed verification: in an approved test integration, attempt role assumption with the correct ID, an incorrect ID and no ID. Confirm only the intended combination works, then inspect the resulting session permissions. Retain the outcomes without publishing credentials or unnecessary customer identifiers.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:30+00:00", "dateModified": "2026-10-20T18:34:28+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Require a vendor-assigned external ID for third-party AWS role access" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 239, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html" } } ] } }