AWS IAM · IAM role review
AWS IAM Role Review Checklist
A structured check for AWS role trust, permissions, session controls, conditions, observability and emergency revocation.
How to use this template
1
Review trust and permission policies as separate control planes.
2
Test the effective role in a non-production boundary where possible.
3
Record exceptions with an owner and expiry.
Copyable template
# AWS IAM role review ## Trust policy - [ ] Every trusted principal is expected and still exists - [ ] Federated subject, audience and repository/environment claims are constrained - [ ] Cross-account trust uses ExternalId or equivalent confused-deputy control where applicable - [ ] Wildcards in principal and condition values are justified ## Permission policy - [ ] Allowed actions match the workload's observed responsibilities - [ ] Resource scope is narrower than * wherever the service supports it - [ ] Condition keys constrain region, network, tags or resource ownership where useful - [ ] PassRole permissions restrict both target roles and consuming services ## Session and operation - [ ] Maximum session duration matches the workflow - [ ] Role sessions have attributable names and CloudTrail evidence - [ ] Permissions boundaries and organisation SCP effects are understood - [ ] Credential revocation and incident response have an owner ## Validation - [ ] IAM Access Analyzer findings reviewed - [ ] Denied and unused permissions considered before expansion - [ ] Negative tests prove an out-of-scope identity or resource is rejected - [ ] Next review date and accountable owner recorded
Engineering signal
Follow AWS IAM failures and fixes
One useful weekly email with new error references, tools, integration notes and production lessons. No daily noise.