IAM roles trusting external accounts

Lists the IAM roles whose trust policy names a principal in an AWS account other than this one. Cross-account trust is the main lateral-movement surface in an account: each result is a role a third party can assume, so review the principal and confirm it is an intended partner, vendor or sibling account. Roles trusting only AWS services or principals within this account are excluded.

Query

SELECT
role_name,
create_date,
CASE WHEN instr(assume_role_policy_document, 'sts%3AExternalId') > 0 THEN 'true' ELSE 'false' END as requires_external_id,
CASE WHEN instr(assume_role_policy_document, 'oidc-provider') > 0 THEN 'true' ELSE 'false' END as trusts_oidc_federation,
CASE WHEN instr(assume_role_policy_document, 'saml-provider') > 0 THEN 'true' ELSE 'false' END as trusts_saml_federation,
assume_role_policy_document
FROM aws.iam.roles
WHERE region = 'us-east-1'
AND instr(REPLACE(assume_role_policy_document, 'iam%3A%3A{{account_id}}', ''), 'iam%3A%3A') > 0;

Notes

assume_role_policy_document is URL-encoded, so the matching works on encoded text: iam%3A%3A is iam::, and the REPLACE strips this account's own ARNs before looking for any remaining account reference. Decode the document to read exact principals. A cross-account role without requires_external_id is the confused-deputy exposure worth prioritising, particularly for vendor integrations - third-party access should always be conditioned on an external id. Roles trusting federation (trusts_oidc_federation or trusts_saml_federation true) admit workloads or workforce identities from a registered identity provider rather than an account principal; inventory those providers with aws/iam/identity-providers. IAM is global, so region = 'us-east-1' is endpoint routing.