# Require a vendor-assigned external ID for third-party AWS role access

> Bind a vendor role assumption to the correct customer relationship.

- Canonical URL: https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-10-20T18:13:30+00:00
- Modified: 2026-10-20T18:34:28+00:00
- Last reviewed by DSE: 2026-10-20
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 2 minutes

## What you need to know

Bind a vendor role assumption to the correct customer relationship.

## Potentially affected

This applies to third-party cross-account role delegation and the confused-deputy risk, rather than password authentication.

## DSE recommendation

DSE recommends obtaining the vendor account identity, assigned external ID and required permissions through the approved onboarding process.

## Article

Bind a vendor role assumption to the correct customer relationship.

## Source facts

AWS recommends an external ID when a third party assumes roles for multiple customers. The vendor assigns a unique customer identifier and includes it in AssumeRole; the customer trust policy checks it. AWS does not treat the external ID as a secret. The role permission policy separately limits permitted actions.

Source: [AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html).

## Applicability

This applies to third-party cross-account role delegation and the confused-deputy risk, rather than password authentication.

## DSE recommendation

DSE recommends obtaining the vendor account identity, assigned external ID and required permissions through the approved onboarding process. Record who owns the integration and its removal procedure. Review the trust policy and permission policy separately. Do not accept a role integration that works without the required customer identifier. Keep the vendor relationship identifier accurate during account migrations, and verify that each customer uses a distinct assignment controlled by the vendor. Record the vendor’s reassignment procedure for account mergers or integration replacement. Require a named reviewer to confirm the trust-policy condition during onboarding, and make removal of the delegation a distinct offboarding step with a retained permission review.

## Verification

Proposed verification: in an approved test integration, attempt role assumption with the correct ID, an incorrect ID and no ID. Confirm only the intended combination works, then inspect the resulting session permissions. Retain the outcomes without publishing credentials or unnecessary customer identifiers.

## Official reference

[AWS Documentation](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html). Reviewed October 20, 2026.

## Primary reference

- Name: AWS Documentation
- Authority: docs.aws.amazon.com
- URL: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Require a vendor-assigned external ID for third-party AWS role access,” DSE Security, https://update.dsesecurity.com/updates/require-a-vendor-assigned-external-id-for-third-party-aws-role-access/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.