Lab 5 · Externally Exposed Role
Find a role external entities can assume and lock it down.
Scenario tie-in
A role's trust policy was left wide open (wildcard principal).
5.1 Find it
- Reports → Monitored Entitlements, filter AWS.
- Look for roles marked public / shared externally.
5.2 Remediate (automated)
- Select role(s) → Run Action → Limit External Access to Role, run now.
Done when
The role can no longer be assumed by arbitrary external principals, verified in DAC.