---
title: Tip: an External ID isn't a password; pin vendor roles to a specific principal and the vendor's IP ranges, and delete roles for tools you've stopped using | ctxsec
url: https://ctxsec.com/items/tip-vendor-cross-account-roles-pin-principal-and-source-ip-remove-unused-trust
description: "In the Qubole case the attacker presented valid External IDs to roles that trusted the vendor's whole account. Three changes would have stopped or contained it."
status: "operational guidance (Wiz recommendations, Nov 9, 2026; AWS External ID guidance)"
published: 2026-11-09
---

> In the Qubole case the attacker presented valid External IDs to roles that trusted the vendor's whole account. Three changes would have stopped or contained it.

[← Tips & Guides](/tips) · [markdown](/items/tip-vendor-cross-account-roles-pin-principal-and-source-ip-remove-unused-trust.md)

operational guidance (Wiz recommendations, Nov 9, 2026; AWS External ID guidance)

2026-11-09

### Tip: an External ID isn't a password; pin vendor roles to a specific principal and the vendor's IP ranges, and delete roles for tools you've stopped using

- **Inventory:** list every IAM role whose trust policy names an external account, and delete or untrust the ones with no recent legitimate AssumeRole activity.
- **Narrow the trust:** replace `arn:aws:iam::<vendor>:root` with the vendor's specific role where supported, and add an `aws:SourceIp` or `aws:SourceVpce` condition for the vendor's documented ranges.
- **Least privilege:** vendor roles rarely need Lambda configuration reads, Secrets Manager, SSM or broad S3 read; remove them.
- **Detect:** alert on third-party AssumeRole from VPNs or hosting providers the vendor has never used, and enable S3 data events for sensitive buckets.
- **Rotate the External ID** with the vendor after any incident, and use a different value per role where you can.

Sources: [Wiz: Trusted by Default, Qubole Cross-Account Access Abused in the Wild (Nov 9, 2026)](https://www.wiz.io/blog/qubole-cross-account-access-abused-in-the-wild) · [AWS IAM User Guide: access to AWS accounts owned by third parties (External ID guidance)](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_third-party.html)