iam

Troubleshoot AWS IAM AssumeRole or AccessDenied failures by validating trust policy requirements, checking required permissions, and identifying common failure causes using AWS CLI-verifiable evidence.

Audit AWS IAM least privilege and cross-account access by applying identity and policy guidance to users, roles, and managed or inline policies, including verifying External IDs for cross-account trust relationships.

Service-Linked Roles create indirect privilege escalation paths in AWS when SLR creation risks and ABAC tag collisions allow unauthorized access, requiring specific SLR security auditing to identify and remediate.

You can validate IAM trust relationships and policy conditions by checking trust policies, required permissions, and IAM condition or policy-pattern considerations, grounding findings in AWS CLI-verifiable evidence.

Your IAM role trust policy prevents cross-account access when trust relationships lack the correct External ID or required permissions, which you can diagnose by checking common trust policy failure causes.

AWS CLI evidence needed to verify IAM permission troubleshooting findings includes trust-policy requirements, IAM condition patterns, and policy attachments that confirm least-privilege design and cross-account authorization.