# AWS IAM Role

> An IAM role holds no cost, so ZopNight evaluates roles for blast radius instead. RC-080 is critical and fires on a wildcard principal in the trust policy; RC-081 is high and fires when the AWS-managed AdministratorAccess policy is attached. Both fail closed when the evidence is missing.

Source: https://zop.dev/integrations/aws/iam-role

---

An IAM role is an assumable identity: a trust policy naming who may assume it, and permission policies describing what they may then do. Holding one is free, so everything interesting about a role is exposure rather than spend.

## A free resource with a blast radius

Roles do not appear in a cost report, which is precisely why they accumulate. Nobody deletes a role to save money, so a role created for a one-week migration in 2023 is probably still assumable today. The question worth asking of a role is not what it costs but what it would cost you if its credentials leaked, and that is a function of two things: who can assume it and what it can do once assumed.

## The trust policy is the first check

RC-080 IAM Role With Wildcard Principal is rated critical, and it reads the trust policy rather than the permission set. A wildcard principal means any AWS principal can attempt to assume the role, which turns every permission attached to it into a permission available beyond your account boundary. Discovery parses the trust policy during the role listing pass and records the finding as a flag on the role, so the rule evaluates a derived fact rather than re-parsing policy JSON at evaluation time.

## AdministratorAccess, derived rather than assumed

RC-081 IAM Role With AdministratorAccess Policy is rated high and fires when the AWS-managed AdministratorAccess policy is attached to the role. The check is deliberately narrow: it names one managed policy, not any policy that happens to be broad, because "broad" is a judgment call and an attached managed policy is a fact. Discovery derives the flag from the role's attached policies, which is what makes the rule answerable.

## Failing closed on missing evidence

Both rules read their flag from the state discovery recorded, and both fail closed when it is absent. A security rule that fires on a missing signal is worse than one that stays quiet, because the finding is unfalsifiable and the reader learns to ignore the category. If the flag is not there, no finding is raised.

## What discovery reads to get there

The role listing pass uses the IAM read actions to enumerate roles, fetch each role, and list both its attached managed policies and its inline policies. Those four reads are what the two flags are derived from, and they are the only IAM permissions the platform needs to reach this verdict.