Constrain the IAM roles an operator can pass to an AWS service

Review indirect service permissions alongside the operator’s own access.

Source facts

iam:PassRole authorizes passing a role to a service in the same AWS account. AWS warns that a caller may indirectly exercise the passed role’s capabilities through the service. Policies can scope allowed role resources and use iam:PassedToService; AWS warns against relying on ResourceTag to control PassRole.

Source: AWS Documentation.

Applicability

This applies to service configuration that accepts an IAM role, rather than ordinary AssumeRole access.

DSE recommendation

DSE recommends inventorying which deployment and support identities can assign workload roles. Limit that list to approved role ARNs and the intended services. Review the permissions of those roles before granting the caller PassRole, especially when the caller cannot directly perform the workload actions. Keep role ownership and deployment ownership in the change record. Avoid a wildcard role resource merely to clear a deployment error; identify the actual role parameter and trust configuration first. Maintain a short mapping from deployment identity to approved service role and business workload. Review new roles against that mapping before granting access, and ask the application owner to justify any capability that the deploying operator is intentionally allowed to exercise indirectly.

Verification

Proposed verification: use a test deployment to pass an approved role, then try a deliberately unapproved role and service combination. Confirm the workload receives only its intended permissions. Review the service configuration event and policy decision rather than expecting PassRole to appear as a standalone API operation.

Official reference

AWS Documentation. Reviewed October 20, 2026.