Require a vendor-assigned external ID for third-party AWS role access

Bind a vendor role assumption to the correct customer relationship.

Source facts

AWS recommends an external ID when a third party assumes roles for multiple customers. The vendor assigns a unique customer identifier and includes it in AssumeRole; the customer trust policy checks it. AWS does not treat the external ID as a secret. The role permission policy separately limits permitted actions.

Source: AWS Documentation.

Applicability

This applies to third-party cross-account role delegation and the confused-deputy risk, rather than password authentication.

DSE recommendation

DSE recommends obtaining the vendor account identity, assigned external ID and required permissions through the approved onboarding process. Record who owns the integration and its removal procedure. Review the trust policy and permission policy separately. Do not accept a role integration that works without the required customer identifier. Keep the vendor relationship identifier accurate during account migrations, and verify that each customer uses a distinct assignment controlled by the vendor. Record the vendor’s reassignment procedure for account mergers or integration replacement. Require a named reviewer to confirm the trust-policy condition during onboarding, and make removal of the delegation a distinct offboarding step with a retained permission review.

Verification

Proposed verification: in an approved test integration, attempt role assumption with the correct ID, an incorrect ID and no ID. Confirm only the intended combination works, then inspect the resulting session permissions. Retain the outcomes without publishing credentials or unnecessary customer identifiers.

Official reference

AWS Documentation. Reviewed October 20, 2026.