Tip: an External ID isn't a password; pin vendor roles to a specific principal and the vendor's IP ranges, and delete roles for tools you've stopped using
- Inventory: list every IAM role whose trust policy names an external account, and delete or untrust the ones with no recent legitimate AssumeRole activity.
- Narrow the trust: replace
arn:aws:iam::<vendor>:rootwith the vendor's specific role where supported, and add anaws:SourceIporaws:SourceVpcecondition for the vendor's documented ranges. - Least privilege: vendor roles rarely need Lambda configuration reads, Secrets Manager, SSM or broad S3 read; remove them.
- Detect: alert on third-party AssumeRole from VPNs or hosting providers the vendor has never used, and enable S3 data events for sensitive buckets.
- Rotate the External ID with the vendor after any incident, and use a different value per role where you can.
Sources: Wiz: Trusted by Default, Qubole Cross-Account Access Abused in the Wild (Nov 9, 2026) · AWS IAM User Guide: access to AWS accounts owned by third parties (External ID guidance)