# AWS IAM role review

## Trust policy
- [ ] Every trusted principal is expected and still exists
- [ ] Federated subject, audience and repository/environment claims are constrained
- [ ] Cross-account trust uses ExternalId or equivalent confused-deputy control where applicable
- [ ] Wildcards in principal and condition values are justified

## Permission policy
- [ ] Allowed actions match the workload's observed responsibilities
- [ ] Resource scope is narrower than * wherever the service supports it
- [ ] Condition keys constrain region, network, tags or resource ownership where useful
- [ ] PassRole permissions restrict both target roles and consuming services

## Session and operation
- [ ] Maximum session duration matches the workflow
- [ ] Role sessions have attributable names and CloudTrail evidence
- [ ] Permissions boundaries and organisation SCP effects are understood
- [ ] Credential revocation and incident response have an owner

## Validation
- [ ] IAM Access Analyzer findings reviewed
- [ ] Denied and unused permissions considered before expansion
- [ ] Negative tests prove an out-of-scope identity or resource is rejected
- [ ] Next review date and accountable owner recorded