awatertrevi/infisical
1
0
Fork 0
mirror of https://github.com/awatertrevi/infisical.git synced 2026-09-22 13:39:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Add confused deputy problem to AWS assume role docs

Browse Source
This commit is contained in:
carlosmonastyrski
2025-04-15 15:41:13 -03:00
parent 68ba807b43
commit d33b06dd8a
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/integrations/app-connections/aws.mdx
View File

@@ -56,7 +56,15 @@ Infisical supports two methods for connecting to AWS.
2. Select **AWS Account** as the **Trusted Entity Type**.
3. Choose **Another AWS Account** and enter **381492033652** (Infisical AWS Account ID). This restricts the role to be assumed only by Infisical. If self-hosting, provide your AWS account number instead.
4. Optionally, enable **Require external ID** and enter your **Organization ID** to further enhance security.
4. (Recommended) <strong>Enable "Require external ID"</strong> and input your **Organization ID** to strengthen security and mitigate the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html).
<Warning type="warning" title="Security Best Practice: Use External ID to Prevent Confused Deputy Attacks">
When configuring an IAM Role that Infisical will assume, it’s highly recommended to enable the **"Require external ID"** option and specify your **Organization ID**.
This precaution helps protect your AWS account against the [confused deputy problem](https://docs.aws.amazon.com/IAM/latest/UserGuide/confused-deputy.html), a potential security vulnerability where a third party could be tricked into performing actions on your behalf by an unauthorized actor.
<strong>Always enable "Require external ID" and use a unique value such as your Organization ID when setting up the IAM Role.</strong>
</Warning>
</Step>
<Step title="Add Required Permissions to the IAM Role">