Ravi Sir's Cards › AWS
Why ExternalId in cross-account trust?
What is a VPC: your own private network inside one AWS Region, example ThreeTierVpc 10.0.0.0/16.
Read card text
What this card says
What it is
A secret-like value the vendor must send in sts:AssumeRole. Your trust policy checks it.
Why it matters
It stops the confused deputy problem: another customer cannot trick the vendor into using your role.
sts:ExternalId
How / example
Condition StringEquals sts:ExternalId = "pune-acme-7731" in the trust policy.