Carry a stable source identity through AWS role sessions for investigation

Connect assumed-role activity to an identity attribute that survives role chaining.

Source facts

AWS can record a configured source identity in CloudTrail for assumed-role activity. Once set, the value cannot change during the session and persists when the role assumes another role. Setting source identity requires the relevant permissions and trust configuration; AWS does not independently control the chosen identity value.

Source: AWS Documentation.

Applicability

This concerns AWS role-session attribution, not proof that any arbitrary caller-supplied label identifies a real person.

DSE recommendation

DSE recommends selecting a stable, accountable attribute from the trusted identity workflow and documenting who can supply it. Review the complete role chain for the required permission before enforcing it in production. Avoid sensitive personal data in the value. Explain how investigators should correlate it with the identity provider and account records. Assign an owner to maintain the mapping when staff identities or federation settings change, and preserve the expected format in support documentation. Define the correlation record investigators should consult when a value is unfamiliar. Review that record’s ownership and retention alongside the role chain, and make a changed identity-provider mapping a reason to repeat the attribution test before relying on it.

Verification

Proposed verification: assume approved test roles with the chosen source identity, follow the intended role chain and inspect the resulting CloudTrail fields. Check behavior when the attribute is missing or unauthorized. Record the evidence linking the supplied attribute to its trusted origin.

Official reference

AWS Documentation. Reviewed October 20, 2026.