Cross-Account Role with ExternalId and Confused Deputy Guard

This trust policy allows a third-party SaaS provider's AWS account to assume a role in your account only when it supplies the correct ExternalId. The ExternalId is a shared secret string that the SaaS vendor generates and you configure in their portal; it prevents the confused deputy problem where an attacker who knows your account ID could trick the vendor into acting on your behalf. Internally, STS compares the sts:ExternalId condition against the value passed in the AssumeRole call and denies if it is missing or mismatched.

This is mandatory for any SaaS integration that needs cross-account access, including Datadog, Snowflake, Databricks, and security scanners. The pattern is also used between your own accounts when a central security account needs read-only access to member accounts, with the ExternalId acting as a second factor beyond the account ID. AWS explicitly recommends it in the Well-Architected Framework for any third-party trust.

Pitfalls: the ExternalId must be treated as a secret and rotated periodically, but many vendors do not support rotation, so document the risk. Never use a predictable value like your account ID or a human-readable name; use a UUIDv4. Also, the condition key is sts:ExternalId, not aws:ExternalId, and it must be a StringEquals, not StringLike, to avoid wildcard bypass. Finally, combine with aws:PrincipalOrgID if the caller is in your organization, and always scope the permissions to the minimum the vendor needs, since many integrations request far more than they use.

> System.Execute()

aws iam create-role --role-name DatadogIntegration \
  --assume-role-policy-document '{
    "Version": "2012-10-17",
    "Statement": [
      {
        "Effect": "Allow",
        "Principal": {"AWS": "arn:aws:iam::987654321098:root"},
        "Action": "sts:AssumeRole",
        "Condition": {
          "StringEquals": {"sts:ExternalId": "a1b2c3d4-e5f6-7890-abcd-ef1234567890"}
        }
      }
    ]
  }'

aws iam attach-role-policy --role-name DatadogIntegration \
  --policy-arn arn:aws:iam::aws:policy/SecurityAudit

> Architecture & Security Context

Verified for Valters IT Hub. When deploying this configuration in a production homelab or enterprise environment, ensure that you monitor system resources and implement strict access controls. Administrator privileges are required.

ID: VALTERSIT-7FCACF194203