Paste a role’s trust policy. See who can get in.
CloudArq answers in your browser, as you type. Nothing you paste leaves this tab.
A deploy role in production, meant for one organisation’s pipelines and written repo:octo-org*. It also trusts one role in another account.
Where do I find a role's trust policy?
In the AWS console: IAM, then Roles, then the role, then its Trust relationships tab. Or from a terminal, with the AWS CLI:
aws iam get-role --role-name your-role-name --query Role.AssumeRolePolicyDocumentAnyone on GitHub can assume this role.
- AnyoneNo grant is placed with people who have no account anywhere.
- Anyone on GitHubAnyone on GitHub can assume this role; no condition confines its tokens to one owner.
- A named outsideraws:111122223333aws:111122223333 can assume this role and is not declared as yours.
- Your pipelinesNo grant is confined to owners declared as yours.
- Your peopleNo grant trusts a SAML provider declared as yours.
Coloured lines get in. Grey lines stop at the door. Point at a group to see why.
Blue: exactly who the policy names. Orange: more than it names.
Printed by cloudarq admits when this page was built. CloudArq in this tab answers next.
- AnyoneKept out
Anyone at all, even without an account anywhere
No grant is placed with people who have no account anywhere.
- Anyone on GitHubGets in
Anyone who can sign up to the service this trust relies on, such as any GitHub user
Anyone on GitHub can assume this role; no condition confines its tokens to one owner.
- A named outsiderGets in
aws:111122223333
aws:111122223333 can assume this role and is not declared as yours.
- Is
aws:111122223333yours?
- Is
- Your pipelinesKept out
Your own CI jobs, limited to your repositories
No grant is confined to owners declared as yours.
- Your peopleKept out
People who sign in through your company's own identity provider
No grant trusts a SAML provider declared as yours.