KBY Technologies Logo
AWS IAM · IAM role review

AWS IAM Role Review Checklist

A structured check for AWS role trust, permissions, session controls, conditions, observability and emergency revocation.

Choose the right control

Use this template when

  • Creating or materially changing an AWS IAM role.
  • Reviewing a federated, cross-account or CI/CD role before renewal.

Use another workflow when

  • You only need to investigate a single denied API call.
  • The identity is an IAM user or service-linked role with a different lifecycle and control model.

Before you start

Collect these inputs before review so unchecked controls become evidence-backed decisions rather than placeholders.

Current trust and permission policy documents
The expected callers, workloads and target resources
CloudTrail and IAM Access Analyzer visibility

How to use this template

1

Review trust and permission policies as separate control planes.

2

Test the effective role in a non-production boundary where possible.

3

Record exceptions with an owner and expiry.

Copyable template
Download .md
# AWS IAM role review

## Trust policy
- [ ] Every trusted principal is expected and still exists
- [ ] Federated subject, audience and repository/environment claims are constrained
- [ ] Cross-account trust uses ExternalId or equivalent confused-deputy control where applicable
- [ ] Wildcards in principal and condition values are justified

## Permission policy
- [ ] Allowed actions match the workload's observed responsibilities
- [ ] Resource scope is narrower than * wherever the service supports it
- [ ] Condition keys constrain region, network, tags or resource ownership where useful
- [ ] PassRole permissions restrict both target roles and consuming services

## Session and operation
- [ ] Maximum session duration matches the workflow
- [ ] Role sessions have attributable names and CloudTrail evidence
- [ ] Permissions boundaries and organisation SCP effects are understood
- [ ] Credential revocation and incident response have an owner

## Validation
- [ ] IAM Access Analyzer findings reviewed
- [ ] Denied and unused permissions considered before expansion
- [ ] Negative tests prove an out-of-scope identity or resource is rejected
- [ ] Next review date and accountable owner recorded

Evidence to retain

Review record

  • Policy simulator or negative-test results
  • Representative CloudTrail role-session records
  • Access Analyzer findings and exception decisions

Definition of done

Acceptance criteria

  • Trusted principals and claims are narrower than the intended caller set.
  • Permissions are limited to required actions and resources.
  • Revocation, ownership and the next review date are recorded.
Worked adaptation

Apply it to a real change

A GitHub Actions workflow assumes a deployment role through OIDC. The review must prove that pull requests and other repositories cannot obtain the production session.

  • Record repository, environment, subject and audience conditions.
  • Run a negative assumption test from an unapproved branch.
  • Link the CloudTrail session to the workflow run and reviewed commit.
Engineering signal

Follow AWS IAM failures and fixes

A useful digest about twice a week with new error references, tools, integration notes and production lessons. No daily noise.